Demystifying Regular Expressions Free Download

Demystifying Regular Expressions
English | Size: 37.78 GB
Genre: eLearning

If you miss an attacker on your network, it’s probably not because you don’t have enough data. It’s more likely that you have too much data.

This happened to me a lot early in my career, particularly when writing Snort signatures or searching for things in a SIEM. Most tools have limited native matching capability, so it always came down to writing regular expressions to dig deeper. I avoided them like the plague.

Seriously, a human wrote this?

^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$

Is this real life?

([a-zA-Z0-9_.-]+)@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.)|(([a-zA-Z0-9-]+\.)+))([a-zA-Z]{2,4}|[0-9]{1,3})

Regular expressions are confusing, hard to read, and it seems like you have to learn a whole new programming language just to make sense of them. My struggles with regex went on for years.

Eventually, I’d run into scenarios where I was at an impasse. Situations like:

Writing a signature to detect an exploit kit, but it involved matching a complex HTTP URI string — I feel like the malware authors do this just to mess with me.
Searching through authentication logs to match specifically formatted usernames, like steve7.smith.sales — seriously, why did sales hire so many Steve Smiths?!
Parsing threat intelligence feeds to match and remove problematic indicators — I’m looking at you 127.0.0.1.
I’d just brush my shortcoming off and focus on other problems or spend a lot of time manually digging through data in my terminal or Excel. When I absolutely had to figure something out I would dig around until I found a similar regex and try to modify it until it fit my use case. I didn’t understand what I was doing or what I created. It got me through, but it also resulted in a lot of wasted time and false positives.

I was in denial, but I eventually realized a harsh truth.