Process Matching

The ‘process match’ can be a simple process name, wildcards, or even a Regular Expression checked against multiple process attributes, such as the user and command line.

Traditional

Traditional process name matching uses a simple wildcard match, with ‘?’ indicating any single character and ‘*’ indicating a sequence of any characters. It is case insensitive. The user name may be appended to the match string with a colon. Depending on the feature, after toggling on path or command line matching, those fields are also compared to the match phrase.

Examples (non-Regex):

chrome.exe
 Match any process named chrome.exe

chrome*
 Match any process that begins with 'chrome'

chrome.exe:bob
 Match any process named chrome.exe running under user 'bob'

Regular Expressions

Process Lasso supports Regular Expression (RegEx) matching to multiple process attributes. This allows for the creation of complex rules not otherwise possible. For instance, a rule could act on Chrome.exe or Firefox.exe when user is Bob or Jeremy. Previously, this would require 4 different rules, but using a Regular Expression they can be combined into one.

You can use our Process Lasso Rule Builder to create these rules or continue below to learn to do it manually.

What is a Regular Expression?

A Regular Expression is a language for pattern matching (and substitution). It has been in use for decades and enjoys widespread support.

A regular expression is a special text string for describing a search pattern. You can think of regular expressions as wildcards on steroids. You are probably familiar with wildcard notations such as *.txt to find all text files in a file manager. The regex equivalent is .*.txt. – RegexBuddy

Read more: Quick Reference (Microsoft) RegEx101 Tester

Use of RegEx in Process Lasso

When matching a RegEx, Process Lasso concatenates multiple fields about the process. The format of this consolidated process information string is:

PID,User,ProcessName,Path,ParentPID,ParentName,,,,CommandLine (always last)

PID process ID User user under which process is running Process basename of process Path file path of process image ParentPID parent ID Parent parent process name CommandLine instance command line (this field is always last. Its index is subject to change if new fields are inserted later!) In this way, an expression can match to anything in the concatenated string, or only to specific fields, depending on how precise the expression is. With Process Lasso, Regular Expressions are differentiated from traditional match phrases by encapsulation in forward slashes (e.g. ‘/myregex/’). All matching is case insensitive. Embedded commas in a field (normally only in the command line field) are escaped with a backslash, so for precise rules this should be taken into account.

Examples

Simple

While RegEx allows for powerful matching on multiple patterns and fields, it can also be used in simple ways:

/firefox.exe/  
 Match 'firefox?exe' anywhere in any field. Note '.' is a wildcard in RegEx, but you can escape it like 'firefox\.exe' for more precision.  

/,firefox\.exe/  
 Match only firefox.exe at the start of a field (>0)  

/,fire*.exe/  
 Match only 'fire*exe' at the start of a field (>0)  

/,(fire*.exe)|(chr*.exe),/  
 Match 'fire*exe' or 'chr*exe' at the start of a field (>0)  

/,app[123]\.exe/  
 Match if any field is app1.exe, app2.exe, or app3.exe (>0)  

/,bobsmith/   
 Match user bobsmith at the start of a field (>0)  

/10280,/  
 Match PID 10280. (simplified form, technically this could match other fields)  

/,.*-type=renderer(^,)*$/  
 Match '-type=renderer' anywhere in last field (command line). Note starts with a comma, then ends before a new field occurs (see below for embedded commas).  

/,.*-type=renderer[^(,)|(\\,)]*$/  
 Prior with handling of escaped embedded commas in the command line.

Advanced

To match specific fields, an expression such as this can be used to match specifically field 3 (the process name):

^([^,]*,){2}
 Explanation:
 ^ = Starts at beginning of string
 ([^,]*,) = Not a comma repeated zero or more times, followed by a comma
 {2} = Repeat prior match (a comma delimited field) 2 times

/^([^,]*,)(jeremy)|(bob),/  
 Match processes with username of jeremy or bob  

/^([^,]*,){2}chrome\.exe,/  
 Match processes named chrome.exe  

/^([^,]*,){2}.*chr.*,/  
 Match processes whose name contains ‘chr’  

/^([^,]*,){2}(chrome\.exe)|(firefox\.exe).*,/  
 Match processes chrome.exe or firefox.exe  

/^([^,]*,){5}boinc\.exe.*,/  
 Match processes that are children of boinc.exe  

^([^,]*,){2}conhost\.exe,([^,]*,){2}boinc\.exe.*,  
 Match processes named conhost.exe that are children of boinc.exe  

/^([^,]*,)(jeremy)|(bob),chrome\.exe/   
 Match processes whose name is chrome.exe under user of jeremy or bob.  

/^([^,]*,){2}chrome.exe,.*,.*-type=renderer[^(,|\\,)]*$  
 Match process name ‘chrome.exe’ and has '-type=renderer' in the command line (last field)  

/^([^,]*,){3}.*\\program files.*/  
 Match path containing ‘\Program Files\’ (matching is case insensitive).

How to test Regular Expressions To test your Regular Expressions, we recommend this site. We’ve preloaded a sample of what you’d be matching against, again with fields being (also see above):

PID,User,Process,Path,ParentPID,Parent,,,,CommandLine (always last)

Alternatively, create a text file with row(s) simulating Process Lasso’s provided match string. Then use grep (WSL or Linux) or another tool to match RegEx. Note that the encapsulating forward slashes need to be removed. An example is:

sample.txt:
20116,jeremy,chrome.exe,C:\Program Files (x86)\Google\Chrome\Application\chrome.exe,19233,chrome.exe,,,,"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer

test command:  
grep -P 'chr.*' sample.txt