3.1 Words with Small Variants and Letter Manipulation - RX
Video Activity
Join over 3 million cybersecurity professionals advancing their career
Sign up with
Required fields are marked with an *
or
Already have an account? Sign In »

Course
Difficulty
Beginner
Video Transcription
00:00
Welcome back to the Reddick's introduction course.
00:03
In our last lesson, we went over the different parameters or regular expression to such a word digits, wild cards, ranges or within the other brackets, right and the length of the quarries. Regardless of being 10 characters from 1 to 10 characters, we also went over parameters such ***
00:21
seer or 11 or more,
00:24
etcetera etcetera.
00:27
Now, for our next model will actually start building regular expressions.
00:32
Now let's say you want to block a malicious word that's been constantly triggering right. This could be content that is illegal. Liska be content that it's a code word for, Let's say, at acquisition that your company is doing right in this case. I use my name for an example. If you
00:51
pretty close attention,
00:53
you can see that you have both upper caps and lower cops. Kay, you have different variations of the letter e. You have a letter three Number three.
01:02
We have ah little symbol of on top of the E, which were like a till day
01:07
and ah, for TV. We have also be right, and for I, we have a one on for the end. We also have a chilled and which is the Indian Spanish right reason. Different symbols, different type of letters and different upper case and lower case in order to cover all these aspects. So
01:23
who Bean building at Rodricks? Based on these parameters? Correct. And the best way to do it is again even the cheat cheat me showing above. So in this case will be using the any off portions so us again. We can click on here and you can see it can add it. Now it will add exactly what's in here on the left side. So in this case,
01:42
it's detecting either a, B or C, which you can see. It's a defecting it down here.
01:46
So we have to modify this and we will be doing is adding all variants up the letter K in this case. And as you can see, I can do either K upper caps or lower cabs.
01:57
Now we'll repeat the same concept for all letters of the word will be detecting right and the reason we're doing it like this, it's we want to capture
02:07
any variant form of the letter, right? So, again, capital
02:12
lower camps.
02:14
In this case, I believe it's
02:15
Yep, 1 30 All right.
02:19
And then we close it
02:21
and then you can see temperatures move.
02:23
And we forgot number three in this case
02:25
there
02:28
in Italy, for example, at a Capitol Ian here, which I don't have an extent example,
02:32
you can see it's still detected.
02:35
Same thing for the next letter,
02:40
the next letter
02:47
and the next letter.
02:51
And this one is out. 164 And I have a Harley fat finger that yes, I did
02:59
There.
03:00
Now you're saying Oh, wired. He wants not firing. It's easy because
03:05
I forgot to add Be here right on the bottom One
03:09
has a special eye,
03:13
which is 1 61 There we go.
03:15
Now let's say somebody uses l. So this type K three the
03:22
l and then the special teal day and right,
03:25
you can still sort determined. That's Kevin, right? So in this case for that to be detected, you also have to add L in here. And this is more like a game off creativity, right?
03:38
And you have to think how the other person or how the militias actor or how the perfect is trying to stake out confidential from Rachel might think, And this is how you will be building this Radic, sis.
03:50
Now let's go over the anchors this start slash end of string.
03:54
I have been having a lot of difficulties actually putting this into play in an information the Curia tools.
04:01
Let me show you why. If I, for example, type ABC, you can see it's highlighted, which means detected. But immediately, if I have something else,
04:12
course
04:14
something before
04:15
it just stops working all right, and it's because it's a string. In this case, it's the holding. So this is very, very
04:24
precise on what you have to write and the kind of of the scenarios we could be typing this. It's when you exactly know what its return and you receive only one value, like, say, an email, for example. Right, And you want to make sure it's not, Let's say Kevin at
04:41
company
04:43
dot com dot you, right.
04:46
And this will be the scenario where if you, for example, time to ***. Same thing
04:53
here, right?
04:58
You see, Now it's detected,
05:00
right?
05:00
And if I do the same thing
05:03
here Sorry.
05:06
There you go.
05:12
See, It works. So
05:14
what happens is if you, for example, get the Valley cold user, and that's the on leave Al you receiving thing. Yes, you can use this and obviously, let's say it's not Kevin. It's
05:26
flash W
05:28
we have, let's say around
05:31
32 15
05:33
current minute being minimum. Then you can see Kevin at this email address will work.
05:39
And then let's say if it's
05:41
sorry,
05:42
Maria
05:45
at that address will also work, and that will be doubled the scenarios where you'll be using this again when it's inside. The only thing you received
05:55
so you know your survival. You know what it is you really wanna comfort is badly out of the different violence you receive. The only problem is most of the time you receive logs and you will have a lot of valleys. Which will you be using to capture we going over our next lesson?
Up Next
3.2 Extracting Data from Windows Log Sources - RX
3.3 Extracting Data from Firewall Log Sources - RX
3.4 Extracting data from Firewall Log Sources Continued - RX
Instructed By
Similar Content