Video Screencast Help
Give us your opinion and win with Symantec! Please help us by taking this survey to tell us about your experience with Symantec Connect, so that we can continue to grow and improve.  Take the survey.

Regular expressions with new line

Created: 03 Jul 2012 • Updated: 31 Oct 2012 | 3 comments
AMyers6671's picture
This issue has been solved. See solution.

We are trying to implement a regular expression to find passwords stored in the clear with Network Discover. We are using a regular expression to do so. The regex looks like this:

^.*(?=.{8,})(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[@#$%^&+=!]).*$

I won't claim to be a regex guru but I've gotten this to work on files if they have only one password on one line. If I put several test passwords on multiple lines it will not match anything. If I change the regex to read as this:

(?m-isx:^.*(?=.{8,})(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[@#0^&+=!]).*$)

I end up matching everything on every line of any text.

Any help here would be greatly appreciated.

Thanks,
Aaron

Comments 3 CommentsJump to latest comment

Mohammad Ashkaibi's picture

Hi Aaron

Honestly my experience in regex is with PGP rather than DLP. Once I opened a case with Tech Support because I wanted to know why using a certain regex (which I googled somewhere) gives "Invalid Condition" message in the PGP Universal server. The regex I tried to use is:

\b(?<!-)((4\d{3})|(5[1-5]\d{2})|(6011))([ -]?)\d{4}\5\d{4}\5\d{4}(?!-)\b|(\b)(?<!-)3[4,7]\d{13}(?!-)\b

I wanted to match outgoing emails with Visa credit card numbers in their bodies/titles. Support Engineer told me this is a 'Microsoft' style regex rather that 'Postgre' style so PGP UN couldn't accept it.

Please have a look at my fresh post related to this topic and I hope you find something useful:

https://www-secure.symantec.com/connect/forums/matching-visa-regex-and-pgp#comment-7897681

Good luck! yes

- Moh

DLP Solutions2's picture

Aaron,

I am not sure what passwords you are looking for. If you are looking for passwords that are similar in format to waht is in a Linux Passwd file, then look at the template that is included on the system for Passwords.

That policy has a REGEX that might be helpful to you on how it detects passwords.

Good luck

Ronak

Please make sure to mark this as a solution

to your problem, when possible.

AMyers6671's picture

We were able to accomplish the task with the following regex

[\s][\w!@#$%^&*]{8}(?<=[\d][\w!@#$%^&*]{0,7})(?<=[a-z][\w!@#$%^&*]{0,7})(?<=[A-Z][\w!@#$%^&*]{0,7})(?<=[!@#$%^&*][\w!@#$%^&*]{0,7})[\s]

Thanks,
Aaron

If this post has helped you, please vote up or mark as solution to help others looking for the same data.

SOLUTION