Regular Expressions

A TryHackMe Practical Exercise Writeup

Introduction:

As a Security Analyst in a Blue Team role, mastering tools and techniques for defending networks and systems is crucial. One such essential tool in your arsenal is regular expressions (regex) — a powerful method for searching, analyzing, and filtering vast amounts of data, often used in log analysis, intrusion detection systems (IDS), and incident response. In this write-up, we will explore the Regular Expressions **CatRegex** room on TryHackMe, walking through regex challenges that are directly applicable to Blue Team operations, helping you detect suspicious activity and identify security threats quickly.

Task 2. Charsets (Security Log Analysis)

Match all of the following characters: c, o, g
[cog]
Match all of the following words: cat, fat, hat
[cfh]at
Match all of the following words: Cat, cat, Hat, hat
[CcHh]at
Match all of the following filenames: File1, File2, file3, file4, file5, File7, file9
[Ff]ile[1-9]
Match all of the filenames of question 4, except “File7” (use the hat symbol)
[Ff]ile[^7]

Task 3: Wildcards and Optional Characters (Intrusion Detection)

Match all of the following words: Cat, fat, hat, rat
.at
Match all of the following words: Cat, cats
[Cc]ats?
Match the following domain name: cat.xyz
cat\.xyz
Match all of the following domain names: cat.xyz, cats.xyz, hats.xyz
[ch]ats?\.xyz
Match every 4-letter string that doesn’t end in any letter from n to z
...[^n-z]
Match bat, bats, hat, hats, but not rat or rats (use the hat symbol)
[^r]ats?

Task 4: Metacharacters and Repetitions (Log Pattern Matching)

Match the following word: catssss
cats{4}
Match all of the following words (use the * sign): Cat, cats, catsss
[Cc]ats*
Match all of the following sentences (use the + sign): regex go br, regex go brrrrrr
regex go br+
Match all of the following filenames: ab0001, bb0000, abc1000, cba0110, c0000 (don’t use a metacharacter)
[abc]{1,3}[01]{4}
Match all of the following filenames: File01, File2, file12, File20, File99
[Ff]ile\d{1,2}
Match all of the following folder names: kali tools, kali tools
kali\s+tools
Match all of the following filenames: notes~, stuff@, gtfob#, lmaoo!
\w{5}\W

Task 5: Starts with/ends with, Groups, and Either/Or (Incident Response)

Match every string that starts with “Password:” followed by any 10 characters excluding “0”, irrespective of the position
Password:[^0]{10}
Match “username: “ in the beginning of a line (note the space!)
^username:\s
Match every line that doesn’t start with a digit (use a metacharacter)
^\D
Match this string at the end of a line: EOF$
EOF\$$
Match all of the following sentences:
I use (nano|vim)

Conclusion:

Regular expressions (regex) are not just for developers or pentesters — they are an invaluable skill for any Blue Team or SOC analyst. Whether you’re analyzing logs, creating rules for intrusion detection systems (IDS), or writing custom scripts for incident response, regex helps streamline these processes, making it easier to detect malicious activity and respond to security incidents.

By mastering these regex patterns through exercises like those in the Regular Expressions CatRegex room on TryHackMe, you’ll be better equipped to defend against cyber threats and maintain the integrity of your organization’s network. Keep refining your skills, and stay vigilant — effective detection and response are key to securing any organization.

Elastic Stack (ELK) for SOC Log Investigations

How I Built a Splunk Homelab for Splunk Certified Core User (SPLK-1001) — Installation, SPL Queries & Dashboard Practice