Regex Editor & Tester

This regular expression matches Windows Security event logs, specifically Event ID 4616, which indicates that the system time was changed. It captures various fields such as the audit outcome, date and time, subject account details, process information, and both the previous and new system times. It is highly useful for SIEM ingestion, system auditing, and detecting potential security tampering or log evasion techniques.