# Regex Library

Nightfall provides detectors for the most common data protection use cases. For unique situations, you can build custom detectors using regular expressions.

### **Secrets Detection**

Please double-check our [detection\_glossary](https://help.nightfall.ai/detection_platform/detection_glossary "mention") before creating your own, including the API and cryptographic key detectors listed below, as regex detectors can introduce noise.  

[**Nightfall's** **API key Detector**](https://docs.nightfall.ai/docs/detecting-secrets) 

Nightfall's API key supports specific detection and validation of API keys for the top 50 vendors and use cases, as shown below. 

| <p>• AWS </p><p>• Azure </p><p>• Confluence</p><p>• Confluent</p><p>• Datadog</p><p>• ElasticSearch</p><p>• Facebook<br>• GCP</p><p>• Google API </p><p>• GitHub</p><p>• GitLab </p><p>• Hugging Face</p><p>• JIRA</p><p>• Nightfall </p><p>• Notion</p><p>• Okta</p><p>• OpenAI</p><p>• PagerDuty</p><p>• Paypal </p><p>• Plaid</p><p>• Postmark</p><p>• Postman</p><p>• Salesforce</p><p>• Sendgrid</p><p>• Slack</p><p>• Snyk</p><p>• Square</p><p>• Stripe</p><p>• Twitter</p><p>• Twilio</p><p>• Zapier</p> | <p><br><br></p><p>• Authentication Token</p><p>• CSRF Token</p><p>• OAuth Token</p><p>• Generic API Key</p><p>• Generic Token</p><p>• JWT</p><p>• Private Key</p><p>• Refresh Token</p><p>• Session Token</p><p></p><p></p><p></p> |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

[**Nightfall's Cryptographic Key Detector**](https://docs.nightfall.ai/docs/detector-glossary#secrets)&#x20;

Nightfall's identifies popular keys for locking or unlocking cryptographic functions, including authentication, authorization, and encryption.

| <p>• DSA Private Key </p><p>• RSA Private Key </p> | <p>• EC Private Key </p><p>• OpenSSH Private Key </p><p>• Private Key </p> | <p>• Encrypted Private Key </p><p>• PGP Private Key Block</p> |
| -------------------------------------------------- | -------------------------------------------------------------------------- | ------------------------------------------------------------- |

You can send us a request for new ML detectors directly in [Nightfall](https://app.nightfall.ai/detection-engine/detectors).&#x20;

<figure><img src="https://2214688951-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg3wgFIu8T7XAT1u-f_%2Fuploads%2FA3OUSZuf5tkAcS7k8MON%2FScreenshot%202023-10-29%20at%204.26.46%E2%80%AFPM.png?alt=media&#x26;token=6aa8ace0-28e7-4e7f-bbac-581a78db1cff" alt=""><figcaption></figcaption></figure>

## REGEX Library

Here is a list of regex detectors used by other Nightfall customers.&#x20;

<table><thead><tr><th>Name</th><th width="415">Detector</th><th>Category</th><th data-hidden>Type</th><th data-hidden>Status</th></tr></thead><tbody><tr><td>google_two_factor_backup</td><td>^(?:BACKUP VERIFICATION CODES|SAVE YOUR BACKUP CODES)[\s\S]{0,300}@$</td><td>Credentials</td><td>Regex</td><td>Global</td></tr><tr><td>heroku_key</td><td>^(heroku_api_key|HEROKU_API_KEY|heroku_secret|HEROKU_SECRET)[a-z_ =\s"'\:]{0,10}[^a-zA-Z0-9-]\w{8}(?:-\w{4}){3}-\w{12}[^a-zA-Z0-9\-]$</td><td>Credentials</td><td>Regex</td><td>Global</td></tr><tr><td>MailGun API Key</td><td>^key-[0-9a-zA-Z]{32}$</td><td>Credentials</td><td>Regex</td><td>Global</td></tr><tr><td>microsoft_office_365_oauth_context</td><td>^https://login.microsoftonline.com/common/oauth2/v2.0/token|https://login.windows.net/common/oauth2/token$</td><td>Credentials</td><td>Regex</td><td>Global</td></tr><tr><td>PayPal Braintree Access Token</td><td>^access_token\$production\$[0-9a-z]{16}\$[0-9a-f]{32}$</td><td>Credentials</td><td>Regex</td><td>Global</td></tr><tr><td>Picatic API Key</td><td>^sk_live_[0-9a-z]{32}$</td><td>Credentials</td><td>Regex</td><td>Global</td></tr><tr><td>ECDSA Private Key</td><td>^-----BEGIN ECDSA PRIVATE KEY-----\s.*,ENCRYPTED(?:.|\s)+?-----END ECDSA PRIVATE KEY-----$</td><td>Credentials</td><td>Regex</td><td>Global</td></tr><tr><td>KeePass 1.x CSV Passwords</td><td>^"Account","Login Name","Password","Web Site","Comments"$</td><td>Credentials</td><td>Regex</td><td>Global</td></tr><tr><td>KeePass 1.x XML Passwords</td><td>^&#x3C;pwlist>\s*?&#x3C;pwentry>[\S\s]*?&#x3C;password>[\S\s]*?&#x3C;\/pwentry>\s*?&#x3C;\/pwlist>$</td><td>Credentials</td><td>Regex</td><td>Global</td></tr><tr><td>Password etc passwd</td><td>^[a-zA-Z0-9\-]+:[x|\*]:\d+:\d+:[a-zA-Z0-9/\- "]*:/[a-zA-Z0-9/\-]*:/[a-zA-Z0-9/\-]+$</td><td>Credentials</td><td>Regex</td><td>Global</td></tr><tr><td>Password etc shadow</td><td>^[a-zA-Z0-9\-]+:(?:(?:!!?)|(?:\*LOCK\*?)|\*|(?:\*LCK\*?)|(?:\$.*\$.*\$.*?)?):\d*:\d*:\d*:\d*:\d*:\d*:$</td><td>Credentials</td><td>Regex</td><td>Global</td></tr><tr><td>MailChimp API Key</td><td>^[0-9a-f]{32}-us[0-9]{1,2}$</td><td>Credentials</td><td>Regex</td><td>Global</td></tr><tr><td>PGP Header</td><td>^-{5}(?:BEGIN|END)\ PGP\ MESSAGE-{5}$</td><td>Credentials</td><td>Regex</td><td>Global</td></tr><tr><td>PKCS7 Encrypted Data</td><td>^(?:Signer|Recipient)Info(?:s)?\ ::=\ \w+|[D|d]igest(?:Encryption)?Algorithm|EncryptedKey\ ::= \w+$</td><td>Credentials</td><td>Regex</td><td>Global</td></tr><tr><td>PuTTY SSH DSA Key</td><td>^PuTTY-User-Key-File-2: ssh-dss\s*Encryption: none(?:.|\s?)*?Private-MAC:$</td><td>Credentials</td><td>Regex</td><td>Global</td></tr><tr><td>PuTTY SSH RSA Key</td><td>^PuTTY-User-Key-File-2: ssh-rsa\s*Encryption: none(?:.|\s?)*?Private-MAC:$</td><td>Credentials</td><td>Regex</td><td>Global</td></tr><tr><td>Samba Password config file</td><td>^[a-z]*:\d{3}:[0-9a-zA-Z]*:[0-9a-zA-Z]*:\[U\ \]:.*$</td><td>Credentials</td><td>Regex</td><td>Global</td></tr><tr><td>SSH DDS Public</td><td>^ssh-dss [0-9A-Za-z+/]+[=]{2}$</td><td>Credentials</td><td>Regex</td><td>Global</td></tr><tr><td>SSH RSA Public</td><td>^ssh-rsa AAAA[0-9A-Za-z+/]+[=]{0,3} [^@]+@[^@]+$</td><td>Credentials</td><td>Regex</td><td>Global</td></tr><tr><td>SSL Certificate</td><td>^-----BEGIN CERTIFICATE-----(?:.|\n)+?\s-----END CERTIFICATE-----$</td><td>Credentials</td><td>Regex</td><td>Global</td></tr><tr><td>Lightweight Directory Access Protocol</td><td>^(?:dn|cn|dc|sn):\s*[a-zA-Z0-9=, ]*$</td><td>Credentials</td><td>Regex</td><td>Global</td></tr><tr><td>Arista network configuration</td><td>^via\ \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3},\ \d{2}:\d{2}:\d{2}$</td><td>Network</td><td>Regex</td><td>Global</td></tr><tr><td>John the Ripper</td><td>^[J,j]ohn\ [T,t]he\ [R,r]ipper|john-[1-9].[1-9].[1-9]|Many\ salts:|Only\ one\ salt:|openwall.com/john/|List.External:[0-9a-zA-Z]*|Loaded\ [0-9]*\ password hash|guesses:\ \d*\ \ time:\ \d*:\d{2}:\d{2}:\d{2}|john\.pot$</td><td>Network</td><td>Regex</td><td>Global</td></tr><tr><td>Huawei config file</td><td>^sysname\ HUAWEI|set\ authentication\ password\ simple\ huawei$</td><td>Network</td><td>Regex</td><td>Global</td></tr><tr><td>Metasploit Module</td><td>^require\ 'msf/core'|class\ Metasploit|include\ Msf::Exploit::\w+::\w+$</td><td>Network</td><td>Regex</td><td>Global</td></tr><tr><td>Network Proxy Auto-Config</td><td>^proxy\.pac|function\ FindProxyForURL\(\w+,\ \w+\)$</td><td>Network</td><td>Regex</td><td>Global</td></tr><tr><td>Nmap Scan Report</td><td>^Nmap\ scan\ report\ for\ [a-zA-Z0-9.]+$</td><td>Network</td><td>Regex</td><td>Global</td></tr><tr><td>Cisco Router Config</td><td>^service\ timestamps\ [a-z]{3,5}\ datetime\ msec|boot-[a-z]{3,5}-marker|interface\ [A-Za-z0-9]{0,10}[E,e]thernet$</td><td>Network</td><td>Regex</td><td>Global</td></tr><tr><td>Simple Network Management Protocol Object Identifier</td><td>^(?:\d\.\d\.\d\.\d\.\d\.\d{3}\.\d\.\d\.\d\.\d\.\d\.\d\.\d\.\d\.\d{4}\.\d)|[a-zA-Z]+[)(0-9]+\.[a-zA-Z]+[)(0-9]+\.[a-zA-Z]+[)(0-9]+\.[a-zA-Z]+[)(0-9]+\.[a-zA-Z]+[)(0-9]+\.[a-zA-Z]+[)(0-9]+\.[a-zA-Z0-9)(]+\.[a-zA-Z0-9)(]+\.[a-zA-Z0-9)(]+\.[a-zA-Z0-9)(]+$</td><td>Network</td><td>Regex</td><td>Global</td></tr><tr><td>Bank of America Routing Numbers - California</td><td>^(?:121|026)00(?:0|9)(?:358|593)$</td><td>Finance</td><td>Regex</td><td>California</td></tr><tr><td>BBVA Compass Routing Number - California</td><td>^321170538$</td><td>Finance</td><td>Regex</td><td>California</td></tr><tr><td>Chase Routing Numbers - California</td><td>^322271627$</td><td>Finance</td><td>Regex</td><td>California</td></tr><tr><td>Citibank Routing Numbers - California</td><td>^32(?:11|22)71(?:18|72)4$</td><td>Finance</td><td>Regex</td><td>California</td></tr><tr><td>USBank Routing Numbers - California</td><td>^12(?:1122676|2235821)$</td><td>Finance</td><td>Regex</td><td>California</td></tr><tr><td>United Bank Routing Number - California</td><td>^122243350$</td><td>Finance</td><td>Regex</td><td>California</td></tr><tr><td>Wells Fargo Routing Numbers - California</td><td>^121042882$</td><td>Finance</td><td>Regex</td><td>California</td></tr><tr><td>SWIFT Codes</td><td>^[A-Za-z]{4}(?:GB|US|DE|RU|CA|JP|CN)[0-9a-zA-Z]{2,5}$</td><td>Finance</td><td>Regex</td><td>Global</td></tr><tr><td>CVE Number</td><td>^CVE-\d{4}-\d{4,7}$</td><td>General</td><td>Regex</td><td>Global</td></tr><tr><td>Dropbox Links</td><td>^https://www.dropbox.com/(?:s|l)/\S+$</td><td>General</td><td>Regex</td><td>Global</td></tr><tr><td>Box Links</td><td>^https://app.box.com/[s|l]/\S+$</td><td>General</td><td>Regex</td><td>Global</td></tr><tr><td>Large number of US Zip Codes</td><td>^(\d{5}-\d{4}|\d{5})$</td><td>General</td><td>Regex</td><td>United States</td></tr><tr><td>MySQL database dump</td><td>^DROP DATABASE IF EXISTS(?:.|\n){5,200}CREATE DATABASE(?:.|\n){5,200}DROP TABLE IF EXISTS(?:.|\n){5,200}CREATE TABLE$</td><td>Database</td><td>Regex</td><td>Global</td></tr><tr><td>MySQLite database dump</td><td>^DROP\ TABLE\ IF\ EXISTS\ \[[a-zA-Z]*\];|CREATE\ TABLE\ \[[a-zA-Z]*\];$</td><td>Database</td><td>Regex</td><td>Global</td></tr></tbody></table>

If you need help with regexes or have regexes you'd like to share, please reach out to <support@nightfall.ai>.&#x20;