RegEx Range

Build a working pattern against real sample text, one construct at a time.

Build a pattern and watch it pass or fail real test cases, live. Intermediate, about 25 minutes.

What you will be able to do

Write a character class that accepts exactly the range you mean and nothing adjacent to it (RegEx Cheat Sheet)
Anchor a pattern so it matches a whole field rather than a substring of one
Use quantifiers and alternation to cover several shapes of the same value without over-matching
Recognize when a pattern only fits the samples in front of you, the failure mode that makes a detection rule useless in production

Notes for teaching it

Works well as a paired exercise: one learner writes the pattern, the other proposes a string that should break it before the Check button is pressed.
The hidden test cases exist to punish over-fitting, so a learner who passes every visible case and still fails has learned the most valuable thing in the drill. Say so before they start, or it reads as the tool being unfair.
This drill is JavaScript regex. Grep/PCRE and RE2 differ on lookaround and backreferences: worth a sentence if the class works in a SIEM.

Find any mention of PowerShell in a log line. Plain characters in a regex match themselves, so no special syntax is needed yet.
Match a drive-letter reference to C:, D:, or E:, but not other drive letters. [ABC] matches any ONE of the characters inside the brackets.
Match a process-ID-looking reference of 4 or more digits in a row (real Windows PIDs are rarely shorter).
Match lines that START with the word ERROR, not lines where ERROR merely appears somewhere inside.
Match a mention of one of three commonly-abused script extensions: vbs, ps1, or bat.
Match the literal text '4624' followed by a period, but not '4624' followed by any OTHER single character. A bare . normally matches ANY character.
Match the standalone word 'admin' as a username, not as part of a longer word like 'administrator' or 'badmin'.
Match a bracketed severity tag that is NOT [INFO], e.g. [WARN], [ERROR], [CRIT]. A caret right after the opening bracket of a character class negates it.
Detect a word typed twice in a row with a space between (a common paste-duplication artifact). Match only when the SAME word repeats.
Match a credential-looking token containing BOTH a digit and an uppercase letter, in any order.
Final challenge: match a genuine IPv4 address (four dot-separated numbers, each in the real 0-255 range) while correctly REJECTING an out-of-range octet like 300 or 999. Counting digits alone will not be enough here.