A character class is a regular-expression construct that matches characters from a specified category or set. Square brackets can combine categories such as word and nonword characters, making a pattern tolerate text such as hyphens. section 21.4
Common character-class patterns include:
- \w matches a word character, while \W matches a nonword character. section 21.4
- [\W\w] combines nonword and word characters, so the match can include characters that \w alone would miss. section 21.4
- A ^ inside square brackets indicates a negative match; outside brackets, ^ anchors the match to the beginning of the string. section 21.2
Finding computer-account logons
To find security events for computer accounts beginning with WIN and ending with TM20$ through TM40$, use WIN[\W\w]+TM[234][0-9]\$. The [\W\w] portion allows a hyphen in the account name, while [234] and [0-9] restrict the ending digits. section 21.4
PS C:\> get-eventlog -LogName security | where { $_.eventid -eq 4624 } |
select -ExpandProperty message | select-string -pattern
"WIN[\W\w]+TM[234][0-9]\$"
Run the PowerShell search against security-log messages and inspect the matching account names. section 21.4
