| Pattern | Regex | Example match | Captures |
|---|
| IPv4 | \b(?<IPv4>\d{1,3}(?:\.\d{1,3}){3})\b | 198.51.100.42 | IPv4=198.51.100.42 |
| IPv4 octets namedinline | \b(?<Oct1>\d{1,3})\.(?<Oct2>\d{1,3})\.(?<Oct3>\d{1,3})\.(?<Oct4>\d{1,3})\b | 10.42.7.13 | Oct1=10
Oct2=42
Oct3=7
Oct4=13 |
| IPv4 octets namedanchored (whole field) | ^(?<Oct1>\d{1,3})\.(?<Oct2>\d{1,3})\.(?<Oct3>\d{1,3})\.(?<Oct4>\d{1,3})$ | 10.42.7.13 | Oct1=10
Oct2=42
Oct3=7
Oct4=13 |
| IPv4 + port | \b(?<IPv4>\d{1,3}(?:\.\d{1,3}){3}):(?<Port>\d{1,5})\b | 192.0.2.45:443 | IPv4=192.0.2.45
Port=443 |
| CIDR notation | \b(?<IPv4>\d{1,3}(?:\.\d{1,3}){3})\/(?<Mask>\d{1,2})\b | 10.0.0.0/24 | IPv4=10.0.0.0
Mask=24 |
| Internal IPprivate + loopback + link-local | ^(?<InternalIP>(?:127\.|10\.|172\.(?:1[6-9]|2\d|3[01])\.|192\.168\.|169\.254\.)\d{1,3}\.\d{1,3}(?:\.\d{1,3})?) | 172.18.4.221 | InternalIP=172.18.4.221 |
| Private (RFC1918) only | \b(?<PrivateIP>10(?:\.\d{1,3}){3}|172\.(?:1[6-9]|2\d|3[01])(?:\.\d{1,3}){2}|192\.168(?:\.\d{1,3}){2})\b | 172.18.4.221 | PrivateIP=172.18.4.221 |
| Loopback (127/8) | \b(?<Loopback>127\.\d{1,3}\.\d{1,3}\.\d{1,3})\b | 127.0.0.1 | Loopback=127.0.0.1 |
| Link-local (169.254/16) | \b(?<LinkLocal>169\.254\.\d{1,3}\.\d{1,3})\b | 169.254.169.254 | LinkLocal=169.254.169.254 |
| Multicast (224/4) | \b(?<Multicast>(?:22[4-9]|23\d)\.\d{1,3}\.\d{1,3}\.\d{1,3})\b | 239.255.255.250 | Multicast=239.255.255.250 |
| Pattern | Regex | Example match | Captures |
|---|
| FQDN | \b(?<FQDN>(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,24})\b | cdn.api.example.co.uk | FQDN=cdn.api.example.co.uk |
| First label splitleftmost / rest | (?<Subdomain>[^.]+)\.(?<Domain>[^\s\/]+) | cdn.api.example.com | Subdomain=cdn
Domain=api.example.com |
| Last 2 labelsapex (single-TLD) | (?<Apex>[a-zA-Z0-9\-]+\.[a-zA-Z]{2,24})$ | api.example.com | Apex=example.com |
| Last 3 labelsapex (double-TLD) | (?<Apex3>[a-zA-Z0-9\-]+\.[a-zA-Z0-9\-]+\.[a-zA-Z]{2,24})$ | api.example.co.uk | Apex3=example.co.uk |
| TLD (last label) | \.(?<TLD>[a-zA-Z]{2,24})(?=[\/:?\s]|$) | example.com | TLD=com |
| TLDdouble-TLD aware | \.(?<TLD>(?:co|com|gov|ac|org|net|edu|or|ne)\.(?:uk|au|jp|br|cn|tr|mx|sg|hk|nz|za|kr|id|in)|[a-zA-Z]{2,24})(?=[\/:?\s]|$) | example.co.uk | TLD=co.uk |
| Punycode / IDN | \b(?<Punycode>xn--[a-zA-Z0-9\-]+(?:\.[a-zA-Z]{2,24})+)\b | xn--gogle-zwa.com | Punycode=xn--gogle-zwa.com |
| Email split | \b(?<Local>[A-Za-z0-9._%+\-]+)@(?<Domain>[A-Za-z0-9.\-]+\.[A-Za-z]{2,24})\b | alice.smith@corp.example.com | Local=alice.smith
Domain=corp.example.com |
| Pattern | Regex | Example match | Captures |
|---|
| Windows pathdecomposed | (?<WinPath>(?<Drive>[A-Za-z]):\\(?<Dir>(?:[^<>:"\/\\|?*\r\n]+\\)*)(?<Filename>[^<>:"\/\\|?*\r\n]+)\.(?<Ext>[A-Za-z0-9]+)) | C:\Users\Public\update.exe | WinPath=C:\Users\Public\update.exe
Drive=C
Dir=Users\Public\
Filename=update
Ext=exe |
| UNC path | \\\\(?<Server>[A-Za-z0-9.\-_]+)\\(?<Share>[A-Za-z0-9$\-_]+)(?:\\(?<UNCPath>[^<>:"\/|?*\r\n]+))? | \\fs01\IT$\install\loader.exe | Server=fs01
Share=IT$
UNCPath=install\loader.exe |
| Linux path | (?<UnixPath>\/(?:[^\/\0\s]+\/)*(?<Filename>[^\/\0\s]+)) | /var/log/syslog | UnixPath=/var/log/syslog
Filename=syslog |
| Filename + extension | \b(?<Filename>[^\\\/:*?"<>|\r\n]+)\.(?<Ext>[A-Za-z0-9]+)\b | payload.exe | Filename=payload
Ext=exe |
| Double extension | (?<Base>[^\\\/:"*?<>|\r\n]+)\.(?<FakeExt>pdf|docx?|xlsx?|pptx?|txt|jpg|jpeg|png|gif|html?|zip|rar|csv|mp[34])\.(?<RealExt>exe|dll|ps1|bat|cmd|vbs|js|wsf|hta|scr|cpl|lnk|com|msi|jar|sh)\b | invoice.pdf.exe | Base=invoice
FakeExt=pdf
RealExt=exe |
| Hidden folder under \Users\\ | (?i)\\Users\\.*?\\(?<HiddenFolder>\.[^\\\r\n]+)\\ | C:\Users\bob\.ssh\id_rsa | HiddenFolder=.ssh |
| Alternate Data Stream | (?<ADS>[A-Za-z]:\\(?:[^<>:"\/\\|?*\r\n]+\\)*[^<>:"\/\\|?*\r\n:]+:(?<Stream>[^<>:"\/\\|?*\r\n]+)) | C:\Users\bob\notes.txt:hidden.exe | ADS=C:\Users\bob\notes.txt:hidden.exe
Stream=hidden.exe |
| Pattern | Regex | Example match | Captures |
|---|
| Strip \Device\HarddiskVolumeN\\ | ^\\Device\\HarddiskVolume\d+(?<Path>[\\\/][^\r\n]+) | \Device\HarddiskVolume3\Windows\notepad.exe | Path=\Windows\notepad.exe |
| Path + filename splitoptional NT prefix | (?:\\Device\\HarddiskVolume\d+)?(?<FilePath>.+\\)(?<FileName>[^\\\r\n]+)$ | C:\Users\Bob\Documents\report.pdf | FilePath=C:\Users\Bob\Documents\
FileName=report.pdf |
| Strip \\?\ namespace | ^\\\\\?\\(?<Path>[A-Z]:\\[^\r\n]+) | \\?\C:\Users\Bob\file.txt | Path=C:\Users\Bob\file.txt |
| Strip \??\ NT object namespace | ^\\\?\?\\(?<Path>[A-Z]:\\[^\r\n]+) | \??\C:\Windows\system32\\ | Path=C:\Windows\system32\\ |
| Strip any NT prefixuniversal | ^(?:\\Device\\\w+\d*|\\\\\?\\|\\\?\?\\|\\GLOBAL\\\?\?\\)(?<Path>[\\\/A-Z][^\r\n]+) | \Device\Mup\server\share | Path=\server\share |
| Pattern | Regex | Example match | Captures |
|---|
| Credentials all-in-onesingle-regex form | (?i)(?:(?<![A-Za-z])(?<CredVar>aws[_-]?secret[_-]?access[_-]?key|aws[_-]?session[_-]?token|azure[_-]?client[_-]?secret|shared[_-]?access[_-]?signature|connection[_-]?string|service[_-]?password|database[_-]?password|github[_-]?token|gitlab[_-]?token|tenant[_-]?secret|slack[_-]?token|bind[_-]?password|proxy[_-]?password|ldap[_-]?password|smtp[_-]?password|sql[_-]?password|db[_-]?password|client[_-]?secret|private[_-]?key|access[_-]?token|refresh[_-]?token|session[_-]?token|bearer[_-]?token|oauth[_-]?token|auth[_-]?token|csrf[_-]?token|sas[_-]?token|id[_-]?token|ssh[_-]?key|x[_-]?api[_-]?key|api[_-]?token|api[_-]?key|mysql[_-]?pwd|sshpass|pgpassword|connstr|credentials|credential|passphrase|password|passwd|webhook|bearer|secret|token|creds|cred|pass|pwd|sas|auth)(?![A-Za-z])\s*[=:\s]\s*['"]?(?<CredVal>[^\s'"&;\r\n]{4,})|\s(?<Flag>(?:--|-|\/)(?:[a-z]+-)?(?:password|passwd|pwd|pass|pw)|(?:--|-|\/)p)[:=\s]+['"]?(?<FlagVal>[^\s'"]+)|\b(?<AtTool>mysql(?:dump|pump|sh)?|7z[a]?|rar|unrar|sshpass)(?:\.exe)?\b[^\r\n]*?\s-p(?<AtVal>[^\-\s][^\s'"]{3,})|(?<UrlScheme>https?|ftps?|sftp|scp|smb|ssh|telnet|rsync|postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|mssql|jdbc:[a-z]+):\/\/(?<UrlUser>[^:@\/\s]*):(?<UrlPass>[^@\/\s]+)@|Authorization:\s*(?<AuthType>Bearer|Basic)\s+(?<AuthVal>[A-Za-z0-9._\-+\/=]+)|ConvertTo-SecureString\s+['"](?<PSCred>[^'"]+)['"]\s+-AsPlainText|\s(?:-U\s+|--user[=\s]+)(?<SMBUser>[^%\s]+)%(?<SMBPass>\S+)|\s(?:--user|-u|--proxy-user)[=\s]+(?<UPUser>[^:\s]+):(?<UPPass>[^\s'"]+)|\bcmdkey\b[^\r\n]*?\/pass:(?<CmdkeyVal>\S+)|\bsc(?:\.exe)?\b[^\r\n]*?\bpassword=\s*(?<ScVal>\S+)|\bnet\s+use\b(?:\s+\S+){1,3}\s+(?<NetUsePass>(?!\/)[^\s\/][^\s]*)\s+\/user:(?<NetUseUser>\S+)|\bnet\s+use\b[^\r\n]*?\/user:(?<NetUseUser2>\S+)\s+(?<NetUsePass2>(?!\/)[^\s\/][^\s]*)|\bnet\s+user\s+(?<NetUserName>\S+)\s+(?<NetUserPass>(?!\/)[^\s\/][^\s]*)|\bwmic\b[^\r\n]*?\/user:(?<WmicUser>\S+)[^\r\n]*?\/password:(?<WmicPass>\S+)|(?<![A-Za-z0-9])(?:-e\s+|--from-literal=|--set(?:-string)?[\s=])(?<ContVar>[A-Za-z_][A-Za-z0-9_\-]*)=['"]?(?<ContVal>[^\s'"]+)|\blftp\b[^\r\n]*?\s(?:-u|--user)\s+(?<LftpUser>[^,\s]+),(?<LftpVal>[^\s'"]+)|\bredis(?:-cli)?\b[^\r\n]*?\s-a\s+['"]?(?<RedisVal>[^\s'"]+)) | plink.exe -ssh user@host -pw S3cret! | Flag=-pw
FlagVal=S3cret! |
| Variable=value credentialfocused: VAR=val / VAR: val only | (?i)(?<![A-Za-z])(?<CredVar>aws[_-]?secret[_-]?access[_-]?key|aws[_-]?session[_-]?token|azure[_-]?client[_-]?secret|shared[_-]?access[_-]?signature|connection[_-]?string|service[_-]?password|database[_-]?password|github[_-]?token|gitlab[_-]?token|tenant[_-]?secret|slack[_-]?token|bind[_-]?password|proxy[_-]?password|ldap[_-]?password|smtp[_-]?password|sql[_-]?password|db[_-]?password|client[_-]?secret|private[_-]?key|access[_-]?token|refresh[_-]?token|session[_-]?token|bearer[_-]?token|oauth[_-]?token|auth[_-]?token|csrf[_-]?token|sas[_-]?token|id[_-]?token|ssh[_-]?key|x[_-]?api[_-]?key|api[_-]?token|api[_-]?key|mysql[_-]?pwd|sshpass|pgpassword|connstr|credentials|credential|passphrase|password|passwd|webhook|bearer|secret|token|creds|cred|pass|pwd|sas|auth)(?![A-Za-z])\s*[=:\s]\s*[\'"]?(?<Credential>[^\s\'"&;\r\n]{4,}) | STRIPE_API_KEY=sk_live_4eC39H | CredVar=API_KEY
Credential=sk_live_4eC39H |
| Short-flag credentialplink/sshpass/sqlcmd/curl/wget/etc. | (?i)\s(?<Flag>(?:--|-|\/)(?:[a-z]+-)?(?:password|passwd|pwd|pass|pw)|(?:--|-|\/)p)[:=\s]+[\'"]?(?<Credential>[^\s\'"]+) | plink.exe -ssh user@host -pw S3cret! | Flag=-pw
Credential=S3cret! |
| Attached short-flagmysql/7z/rar/sshpass -p<value> (no space) | (?i)\b(?<Tool>mysql(?:dump|pump|sh)?|7z[a]?|rar|unrar|sshpass)(?:\.exe)?\b[^\r\n]*?\s-p(?<Credential>[^\-\s][^\s\'"]{3,}) | mysql -u admin -pS3cret!Pwd dbname | Tool=mysql
Credential=S3cret!Pwd |
| redis-cli -a | (?i)\bredis(?:-cli)?\b[^\r\n]*?\s-a\s+[\'"]?(?<Credential>[^\s\'"]+) | redis-cli -h cache.local -a R3disPass! | Credential=R3disPass! |
| User:pass flagcurl/wget -u user:pass / --user / --proxy-user | (?i)\s(?<Flag>--user|-u|--proxy-user)[=\s]+(?<User>[^:\s]+):(?<Credential>[^\s\'"]+) | curl --user alice:S3cret! https://api.example.com | Flag=--user
User=alice
Credential=S3cret! |
| net user account | (?i)\bnet\s+user\s+(?<User>\S+)\s+(?<Password>(?!\/)[^\s\/][^\s]*) | net user svc_admin S3cret!Pwd /add | User=svc_admin
Password=S3cret!Pwd |
| SSH private key flag | (?i)\bssh\b[^\r\n]*?-i\s+[\'"]?(?<KeyPath>[^\s\'"]+) | ssh -i ~/.ssh/id_rsa user@host | KeyPath=~/.ssh/id_rsa |
| Bearer token (header) | (?i)Authorization:\s*Bearer\s+(?<Bearer>[A-Za-z0-9._\-]+) | Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.payload.sig | Bearer=eyJhbGciOiJIUzI1NiJ9.payload.sig |
| Basic auth (header) | (?i)Authorization:\s*Basic\s+(?<BasicAuth>[A-Za-z0-9+\/=]+) | Authorization: Basic YWRtaW46c2VjcmV0 | BasicAuth=YWRtaW46c2VjcmV0 |
| PowerShell SecureStringplaintext literal | ConvertTo-SecureString\s+[\'"](?<Credential>[^\'"]+)[\'"]\s+-AsPlainText | $p = ConvertTo-SecureString 'P@ssw0rd!' -AsPlainText -Force | Credential=P@ssw0rd! |
| SMB user%passsmbclient/smbmap | (?i)\s(?:-U\s+|--user[=\s]+)(?<User>[^%\s]+)%(?<Password>\S+) | smbclient //server/share -U DOMAIN\admin%S3cret! | User=DOMAIN\admin
Password=S3cret! |
| cmdkey /pass: | (?i)\bcmdkey\b[^\r\n]*?\/pass:(?<Credential>\S+) | cmdkey /add:server01 /user:CORP\admin /pass:S3cret! | Credential=S3cret! |
| sc.exe password=service install/config | (?i)\bsc(?:\.exe)?\b[^\r\n]*?\bpassword=\s*(?<Credential>\S+) | sc.exe create BackupSvc binpath= C:\bak.exe obj= .\svc password= S3cret! | Credential=S3cret! |
| net use w/ credsPASS before /user: (canonical) | (?i)\bnet\s+use\b(?:\s+\S+){1,3}\s+(?<Password>(?!\/)[^\s\/][^\s]*)\s+\/user:(?<User>\S+) | net use \\fs01\share Pass123 /user:CORP\admin | Password=Pass123
User=CORP\admin |
| net use w/ creds/user: before PASS (alt order) | (?i)\bnet\s+use\b[^\r\n]*?\/user:(?<User>\S+)\s+(?<Password>(?!\/)[^\s\/][^\s]*) | net use \\fs01\share /user:CORP\admin Pass123 | User=CORP\admin
Password=Pass123 |
| lftp -u user,pass | (?i)\blftp\b[^\r\n]*?\s(?:-u|--user)\s+(?<User>[^,\s]+),(?<Credential>[^\s\'"]+) | lftp -u alice,S3cret!Pwd ftp.example.com | User=alice
Credential=S3cret!Pwd |
| wmic /user: /password: | (?i)\bwmic\b[^\r\n]*?\/user:(?<User>\S+)[^\r\n]*?\/password:(?<Password>\S+) | wmic /node:HOST /user:admin /password:Pass1 process call create | User=admin
Password=Pass1 |
| Container env injectiondocker -e / k8s --from-literal / helm --set | (?i)(?<![A-Za-z0-9])(?:-e\s+|--from-literal=|--set(?:-string)?[\s=])(?<Var>[A-Za-z_][A-Za-z0-9_\-]*)=[\'"]?(?<Credential>[^\s\'"]+) | docker run -e MYSQL_ROOT_PASSWORD=R00t! mysql:8 | Var=MYSQL_ROOT_PASSWORD
Credential=R00t! |
| Pattern | Regex | Example match | Captures |
|---|
| MD5 | \b(?<MD5>[a-fA-F0-9]{32})\b | 5d41402abc4b2a76b9719d911017c592 | MD5=5d41402abc4b2a76b9719d911017c592 |
| SHA1 | \b(?<SHA1>[a-fA-F0-9]{40})\b | aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d | SHA1=aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d |
| SHA256 | \b(?<SHA256>[a-fA-F0-9]{64})\b | 2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae | SHA256=2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae |
| GUID / UUID | \b(?<GUID>[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12})\b | 550e8400-e29b-41d4-a716-446655440000 | GUID=550e8400-e29b-41d4-a716-446655440000 |
| Windows SID | \b(?<SID>S-1-(?:0|1|2|3|4|5|9|11|12|15|16|18)(?:-\d+)+)\b | S-1-5-21-3623811015-3361044348-30300820-1013 | SID=S-1-5-21-3623811015-3361044348-30300820-1013 |
| bcrypt hash | (?<Bcrypt>\$2[abxy]\$\d{2}\$[A-Za-z0-9.\/]{53}) | $2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy | Bcrypt=$2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy |
| argon2 hash | (?<Argon2>\$argon2(?:i|d|id)\$v=\d+\$m=\d+,t=\d+,p=\d+\$[A-Za-z0-9+\/=]+\$[A-Za-z0-9+\/=]+) | $argon2id$v=19$m=65536,t=3,p=4$c29tZXNhbHQ$RdescudvJCsgt3ub+b+dWRWJTmaaJObG | Argon2=$argon2id$v=19$m=65536,t=3,p=4$c29tZXNhbHQ$RdescudvJCsgt3ub+b+dWRWJTmaaJObG |
| SHA512crypt hash | (?<Sha512Crypt>\$6\$(?:rounds=\d+\$)?[A-Za-z0-9.\/]{8,16}\$[A-Za-z0-9.\/]{86}) | $6$rounds=5000$saltvalu1$ABcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789./abcdefghij1234567890abcde | Sha512Crypt=$6$rounds=5000$saltvalu1$ABcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789./abcdefghij1234567890ab |
| Pattern | Regex | Example match | Captures |
|---|
| AWS Access Key ID | \b(?<AWSKey>(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|APKA)[0-9A-Z]{16})\b | AKIAIOSFODNN7EXAMPLE | AWSKey=AKIAIOSFODNN7EXAMPLE |
| AWS ARNdecomposed | arn:(?<Partition>aws|aws-cn|aws-us-gov):(?<Service>[a-z0-9\-]+):(?<Region>[a-z]+-[a-z]+-\d+)?:(?<AcctId>\d{12})?:(?<Resource>[A-Za-z0-9\/:\-_.+*]+) | arn:aws:iam::123456789012:user/David | Partition=aws
Service=iam
AcctId=123456789012
Resource=user/David |
| S3 URI | s3:\/\/(?<Bucket>[a-z0-9][a-z0-9.\-]{1,61}[a-z0-9])(?:\/(?<Key>\S+))? | s3://corp-backups/db/snap-2024-q3.bak | Bucket=corp-backups
Key=db/snap-2024-q3.bak |
| EC2 instance ID | \b(?<EC2>i-[0-9a-f]{8,17})\b | i-0abcd1234ef56789 | EC2=i-0abcd1234ef56789 |
| Azure subscription ID | \b(?<AzSubId>[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})\b | 7d1d6c4e-4d7e-4a6e-9f3e-2c1b0a3d5e6f | AzSubId=7d1d6c4e-4d7e-4a6e-9f3e-2c1b0a3d5e6f |
| Azure SAS signature | \?sv=\d{4}-\d{2}-\d{2}&(?:[a-z]+=[^&\s]+&)*sig=(?<SASsig>[A-Za-z0-9%]+) | ?sv=2023-08-03&ss=b&srt=sco&sig=XyABCdef123%2FabcdEFGH | SASsig=XyABCdef123%2FabcdEFGH |
| GCP API key | \b(?<GCPKey>AIza[0-9A-Za-z_\-]{35})\b | AIzaSyA-9tSrke72PouQMnMX-a7eZSW0jkFMBWY | GCPKey=AIzaSyA-9tSrke72PouQMnMX-a7eZSW0jkFMBWY |
| GitHub PAT (any) | \b(?<GHPAT>(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,251}|github_pat_[A-Za-z0-9_]{82})\b | ghp_16C7e42F292c6912E7710c838347Ae178B4a | GHPAT=ghp_16C7e42F292c6912E7710c838347Ae178B4a |
| JWT3 parts | \beyJ(?<Header>[A-Za-z0-9_\-]+)\.eyJ(?<Payload>[A-Za-z0-9_\-]+)\.(?<Sig>[A-Za-z0-9_\-]+)\b | eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NSJ9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c | Header=hbGciOiJIUzI1NiJ9
Payload=zdWIiOiIxMjM0NSJ9
Sig=SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c |
| PEM private key block | -----BEGIN (?:RSA |DSA |EC |OPENSSH |ENCRYPTED |PGP )?PRIVATE KEY-----[A-Za-z0-9+\/=\s]{200,}-----END (?:RSA |DSA |EC |OPENSSH |ENCRYPTED |PGP )?PRIVATE KEY----- | -----BEGIN RSA PRIVATE KEY-----MIIEowIBAAKCAQEAvGjfzVvDOGKlR2bnJ8VFcVHwxIDvCKbuVBLtMjQHdy3JQVRpITi3WsQwaLb6CtMHYjGo8q9bDLB6q7PQg4zGNXHkb9wKpBvbJpVZwKvCK4hPgC1k/8oSdf9oAlLBL7G0mjlHrW/qDCqLP7Y7+y8nZ0VZGGqLi7B7CxDpQ3mF2X6JMc4fG9wBYbYKy1jJ0WqKvZ-----END RSA PRIVATE KEY----- | (full match) |
| Slack token | \b(?<Slack>xox[baprs]-[A-Za-z0-9\-]+)\b | xoxb-12345-67890-AbCdEfGhIjKlMnOp | Slack=xoxb-12345-67890-AbCdEfGhIjKlMnOp |
| Discord webhook | https:\/\/(?:ptb\.|canary\.)?discord(?:app)?\.com\/api\/webhooks\/(?<ChannelId>\d{17,20})\/(?<Token>[A-Za-z0-9_\-]+) | https://discord.com/api/webhooks/12345678901234567/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789AB | ChannelId=12345678901234567
Token=abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789AB |
| Stripe API key | \b(?<Stripe>(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9]+)\b | sk_live_4eC39HabcdefGHIJK1234567890XYZ | Stripe=sk_live_4eC39HabcdefGHIJK1234567890XYZ |
| Pattern | Regex | Example match | Captures |
|---|
| PowerShell EncodedCommandobfuscation-resistant | [`]*[\-\/–—][^A-Za-z]*e[ncodema"`\'\s]*\s+(?<EncodedCommand>[A-Za-z0-9+\/="`\'\s]+) | pwsh -e`n`c`o`d`e`d JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAA= | EncodedCommand=JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAA= |
| Base64standard | (?:[A-Za-z0-9+\/]{4}){8,}(?:[A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=)? | SGVsbG8gV29ybGQhIFRoaXMgaXMgYSB0ZXN0Lg== | (full match) |
| Base64URL-safe | (?:[A-Za-z0-9_\-]{4}){8,}={0,2} | dGhpcy1pcy1hLXVybC1zYWZlLWJhc2U2NC1leGFtcGxl | (full match) |
| Base64 PowerShell prefixUTF-16LE encoded command | \b(?<PSEncoded>(?:JAB|SQB|IAA|PAA|JgB|cwB|aQB|YwB|RQB)[A-Za-z0-9+\/=]{20,})\b | JABjAGwAaQBlAG4AdAA9AE4AZQB3AC0ATwBiAGoAZQBjAHQA | PSEncoded=JABjAGwAaQBlAG4AdAA9AE4AZQB3AC0ATwBiAGoAZQBjAHQA |
| Hex blob | \b(?<Hex>[a-fA-F0-9]{64,})\b | 4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000 | Hex=4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000 |
| Hex escaped (\xNN) | (?:\\x[a-fA-F0-9]{2}){8,} | \x4d\x5a\x90\x00\x03\x00\x00\x00 | (full match) |
| Hex C-array (0xNN,) | (?:0x[a-fA-F0-9]{1,2},\s*){8,}0x[a-fA-F0-9]{1,2} | 0x4d, 0x5a, 0x90, 0x00, 0x03, 0x00, 0x00, 0x00, 0xff | (full match) |
| URL-encoded run | (?:%[0-9a-fA-F]{2}){4,} | %63%6d%64%2e%65%78%65%20%2f%63 | (full match) |
| Unicode escape (\uNNNN) | (?:\\u[0-9a-fA-F]{4}){4,} | \u0063\u006d\u0064\u002e\u0065\u0078\u0065 | (full match) |
| Pattern | Regex | Example match | Captures |
|---|
| ASCII only | ^[\x00-\x7F]+$ | Hello123 | (full match) |
| Printable ASCII only | ^[\x20-\x7E]+$ | Hello, World! | (full match) |
| Contains non-ASCII | (?<NonAscii>[^\x00-\x7F]) | paypaӏ.com | NonAscii=ӏ |
| Cyrillic | [\x{400}-\x{4FF}\x{500}-\x{52F}\x{2DE0}-\x{2DFF}\x{A640}-\x{A69F}\x{1C80}-\x{1C8F}]
[\u0400-\u04FF\u0500-\u052F\u2DE0-\u2DFF\uA640-\uA69F\u1C80-\u1C8F] | раураl.com | matched (× 5): р, а, у, р, а |
| Greek | [\x{370}-\x{3FF}\x{1F00}-\x{1FFF}]
[\u0370-\u03FF\u1F00-\u1FFF] | αβγ | matched (× 3): α, β, γ |
| Arabic | [\x{600}-\x{6FF}\x{750}-\x{77F}\x{8A0}-\x{8FF}\x{FB50}-\x{FDFF}\x{FE70}-\x{FEFF}]
[\u0600-\u06FF\u0750-\u077F\u08A0-\u08FF\uFB50-\uFDFF\uFE70-\uFEFF] | مرحبا | matched (× 5): م, ر, ح, ب, ا |
| Hebrew | [\x{590}-\x{5FF}\x{FB1D}-\x{FB4F}]
[\u0590-\u05FF\uFB1D-\uFB4F] | שלום | matched (× 4): ש, ל, ו, ם |
| CJK unified | [\x{4E00}-\x{9FFF}\x{3400}-\x{4DBF}\x{F900}-\x{FAFF}]
[\u4E00-\u9FFF\u3400-\u4DBF\uF900-\uFAFF] | 你好 | matched (× 2): 你, 好 |
| Hiragana | [\x{3040}-\x{309F}]
[\u3040-\u309F] | こんにちは | matched (× 5): こ, ん, に, ち, は |
| Katakana | [\x{30A0}-\x{30FF}\x{31F0}-\x{31FF}]
[\u30A0-\u30FF\u31F0-\u31FF] | カタカナ | matched (× 4): カ, タ, カ, ナ |
| Hangul (Korean) | [\x{AC00}-\x{D7AF}\x{1100}-\x{11FF}\x{3130}-\x{318F}]
[\uAC00-\uD7AF\u1100-\u11FF\u3130-\u318F] | 안녕하세요 | matched (× 5): 안, 녕, 하, 세, 요 |
| Latin Extendedhomoglyph source | [\x{C0}-\x{24F}\x{1E00}-\x{1EFF}]
[\u00C0-\u024F\u1E00-\u1EFF] | éàçÑ | matched (× 4): é, à, ç, Ñ |
| Math alphanumerichomoglyph attack | [\x{1D400}-\x{1D7FF}]
[\U0001D400-\U0001D7FF] | 𝐀𝐁𝐂 | matched (× 3): 𝐀, 𝐁, 𝐂 |
| Zero-width / formatting | [\x{200B}-\x{200F}\x{202A}-\x{202E}\x{2060}-\x{206F}\x{FEFF}]
[\u200B-\u200F\u202A-\u202E\u2060-\u206F\uFEFF] | user\u200Bname | matched: \u200B |
| Combining marks | [\x{300}-\x{36F}]
[\u0300-\u036F] | e\u0301 | matched: \u0301 |