$re = '/.*wmic.*process.*call.*create.*|.*invoke-wmimethod.*(-class win32_process|-name create).*(-name create|-class win32_process).*/mi';
$str = 'wmic process call create
wmic process call create “notepad.exe”
wmic /node:IP process call create “calc.exe”
wmic /node:10.146.215.157 process call create "notepad.exe"
invoke-wmimethod -Class win32_process -Name create -ArguementList "calc.exe" -ComputerName "tdiscwin-as-t1p"
Invoke-WmiMethod -Class win32_process -Name create -ArguementList "calc.exe" -ComputerName "tdiscwin-as-t1p"
Invoke-WmiMethod -Class Win32_Process -name Create -ArguementList \'notepad.exe\' -ComputerName 192.168.72.134 - Credential \'WIN-B85AAA7ST4U\\Administrator\'
Invoke-WmiMethod -ComputerName Test -Class Win32_Process -Name Create -ArgumentList "Notepad.exe"
Invoke-WmiMethod -Name Create -Class Win32_Process -ArgumentList "Notepad.exe"';
preg_match_all($re, $str, $matches, PREG_SET_ORDER, 0);
// Print the entire match result
var_dump($matches);
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for PHP, please visit: http://php.net/manual/en/ref.pcre.php