Is it possible to use a variable in a regex? | View post

opoplawski 1 year ago

Is it possible to use a variable in a regex? I'm trying to do something like the following:

Exec if ($EventID == 4104) {
   if defined(get_var('scriptblockid')) {
      $id = get_var('scriptblockid');
      if ($Message =~ /ScriptBlock ID: $id/) drop();
   }
   if ($Message =~ /ClassName = 'Root\/Microsoft\/Windows/) {
       if ($Message =~/ScriptBlock ID: (\S+)/) {
           set_var('scriptblockid', $1);
       }
       drop();
   }
}