using System;
using System.Text.RegularExpressions;
public class Example
{
public static void Main()
{
string pattern = @"^([[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\.[[:digit:]]{1,3}\s)([a-zA-Z0-9_.\[\]\(\)\-:\s]{1,})\s(ModSecurity:\sWarning.\s)([a-zA-Z0-9\""\/\_\.\[\]\(\)\-:\s]{1,})(\s\[severity ""CRITICAL""\]\s)([a-zA-Z0-9\""\/\_\.\[\]\(\)\-:\s]{1,})\s(""OWASP_CRS\/)";
string input = @"129.232.250.201 [Tue Apr 30 14:01:54 2019] [error] [pid 23850] apache2_util.c(271) [client 196.40.111.5:39554 ] - [client 196.40.111.5] ModSecurity: Warning. Matched phrase ""bin/bash"" at ARGS_NAMES:/bin/bash. [file ""/opt/modsecurity/owasp-modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf""] [line ""503""] [id ""932160""] [msg ""Remote Command Execution: Unix Shell Code Found""] [data ""Matched Data: bin/bash found within ARGS_NAMES:/bin/bash: /bin/bash""] [severity ""CRITICAL""] [ver ""OWASP_CRS/3.1.0""] [tag ""application-multi""] [tag ""language-shell""] [tag ""platform-unix""] [tag ""attack-rce""] [tag ""OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION""] [tag ""WASCTC/WASC-31""] [tag ""OWASP_TOP_10/A1""] [tag ""PCI/6.5.2""] [hostname ""dedi-staging15.jnb1.host-h.net""] [uri ""/test/""] [unique_id ""XMg5MoHo@skAAF0qGI4AAAAE""]";
Match m = Regex.Match(input, pattern);
Console.WriteLine("'{0}' found at index {1}", m.Value, m.Index);
}
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for C#, please visit: https://msdn.microsoft.com/en-us/library/system.text.regularexpressions.regex(v=vs.110).aspx