Customer Guidance for Reported Zero-day Vulnerabilities in Microsoft Exchange Server

4ppl3c0r3 Thanks for your input. I am more familiar with unix regular expressions. They have a lot in common. I cannot see why this statement has a hit: 

echo "a=autodiscover xxx b=powershell" | Select-String -Pattern "(?=.*autodiscover)(?=.*powershell)"

The ( and ) only groups thing, The "=" is a literal "=". So it should not find it.

But as you say "if you find the word "autodiscover" and the word "powershell," in either order" this also gives a hit. So I understand probably not some fundamentals of -pattern. I have read the documentation though.

echo "b=powershell a=autodiscover" | Select-String -Pattern "(?=.*autodiscover)(?=.*powershell)"

 I understand the ^and $ for going into Singleline mode.

I do not understand why you added: 

(?:.*)

Aha now I found it.  The ? is not "match any character" if it is in between ( and ). It means:

(? = Balancing Group Definition

and

(?:.*) = Noncapturing Groups.  The following grouping construct does not capture the substring that is matched by a subexpression: (?:subexpression)