REGEX PATTERN ARSENAL

PATTERN LIBRARY

Combat-tested regex patterns for cybersecurity operations, digital forensics, and threat hunting.COPY, DEPLOY, DOMINATE

PATTERNS

Network & Security

IPv4 Address

Matches IPv4 addresses in logs and network data

REGEX PATTERN:

\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b

EXAMPLE MATCHES:

192.168.1.100, 10.0.0.1

Network traffic analysis, firewall logs

MAC Address

Matches MAC addresses in various formats

REGEX PATTERN:

([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})

EXAMPLE MATCHES:

AA:BB:CC:DD:EE:FF, aa-bb-cc-dd-ee-ff

Network device identification, ARP tables

URL/Domain

Matches HTTP/HTTPS URLs and domains

REGEX PATTERN:

https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&//=]*)

EXAMPLE MATCHES:

https://example.com/path?param=value

Web traffic analysis, malicious URL detection

Port Numbers

Matches port numbers in network addresses

REGEX PATTERN:

:\d{1,5}\b

EXAMPLE MATCHES:

:80, :443, :8080

Service discovery, port scanning logs

File & System

File Paths (Windows)

Matches Windows file paths

REGEX PATTERN:

[A-Za-z]:\\(?:[^\\/:*?"<>|\r\n]+\\)*[^\\/:*?"<>|\r\n]*

EXAMPLE MATCHES:

C:\Users\Admin\Documents\file.txt

Log analysis, malware file tracking

File Paths (Unix)

Matches Unix/Linux file paths

REGEX PATTERN:

\/(?:[^\s\/]+\/)*[^\s\/]*

EXAMPLE MATCHES:

/home/user/documents/file.txt

Linux log analysis, file system monitoring

Hash Values (MD5/SHA)

Matches MD5 (32) or SHA-256 (64) hash values

REGEX PATTERN:

\b[a-fA-F0-9]{32,64}\b

EXAMPLE MATCHES:

d41d8cd98f00b204e9800998ecf8427e

Malware signatures, file integrity checks

Registry Keys

Matches Windows registry keys

REGEX PATTERN:

HKEY_[A-Z_]+\\[^\n\r]*

EXAMPLE MATCHES:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft

Registry forensics, malware persistence analysis

Authentication & Data

Email Address

Matches email addresses

REGEX PATTERN:

[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}

EXAMPLE MATCHES:

[email protected], [email protected]

User identification, phishing analysis

Credit Card Numbers

Matches credit card numbers with separators

REGEX PATTERN:

\b(?:\d[ -]*?){13,16}\b

EXAMPLE MATCHES:

4111 1111 1111 1111, 5555-5555-5555-4444

PCI compliance, data leak detection

Social Security Numbers

Matches US Social Security Numbers

REGEX PATTERN:

\b\d{3}-\d{2}-\d{4}\b

EXAMPLE MATCHES:

123-45-6789

PII detection, compliance monitoring

Phone Numbers

Matches US phone numbers in common formats

REGEX PATTERN:

\(\d{3}\)\s?\d{3}-\d{4}|\d{3}-\d{3}-\d{4}

EXAMPLE MATCHES:

(555) 123-4567, 555-123-4567

Contact information extraction

Log Analysis

Timestamp (ISO 8601)

Matches ISO 8601 timestamp formats

REGEX PATTERN:

\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}(?:\.\d{3})?(?:Z|[+-]\d{2}:\d{2})?

EXAMPLE MATCHES:

2024-01-15T10:30:45.123Z

Log parsing, timeline analysis

HTTP Status Codes

Matches HTTP status codes

REGEX PATTERN:

\b[1-5]\d{2}\b

EXAMPLE MATCHES:

200, 404, 500

Web server log analysis, error tracking

Syslog Priority

Matches syslog priority values

REGEX PATTERN:

<\d{1,3}>

EXAMPLE MATCHES:

<134>, <86>

Syslog parsing, message classification

Process ID (PID)

Matches process IDs in logs

REGEX PATTERN:

\bPID[:\s]*(\d+)

EXAMPLE MATCHES:

PID: 1234, PID 5678

Process tracking, incident correlation

Threat Intelligence

Bitcoin Address

Matches Bitcoin wallet addresses

REGEX PATTERN:

\b[13][a-km-zA-HJ-NP-Z1-9]{25,34}\b

EXAMPLE MATCHES:

1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa

Cryptocurrency tracking, ransomware analysis

CVE Identifiers

Matches Common Vulnerabilities and Exposures IDs

REGEX PATTERN:

CVE-\d{4}-\d{4,}

EXAMPLE MATCHES:

CVE-2021-44228, CVE-2023-12345

Vulnerability management, threat intelligence

Base64 Data

Matches Base64 encoded strings

REGEX PATTERN:

(?:[A-Za-z0-9+\/]{4})*(?:[A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})

EXAMPLE MATCHES:

SGVsbG8gV29ybGQ=

Encoded payload detection, data exfiltration

Suspicious PowerShell

Matches suspicious PowerShell commands

REGEX PATTERN:

(Invoke-Expression|IEX|DownloadString|Invoke-WebRequest|powershell\.exe.*-enc)

EXAMPLE MATCHES:

powershell.exe -enc SGVsbG8=

Malware detection, command injection analysis

PATTERN TESTER

Test regex patterns against sample data before deploying in production

LIVE PATTERN TESTING

Copy any pattern above and test it against your data

REGEX PATTERN:

TEST DATA:

OPERATIONAL SECURITY NOTICE

These regex patterns are provided for legitimate cybersecurity, forensics, and system administration purposes. Always ensure compliance with your organization's policies and applicable laws when processing sensitive data.

BEST PRACTICES:

• Test patterns in isolated environments before production use
• Be aware of performance implications with complex patterns
• Consider privacy implications when matching PII data
• Document pattern usage for audit and compliance purposes
• Regular expressions can be CPU-intensive - optimize accordingly