title: Regex: Match malicious ASP session ID
body: <p>I'm trying to create a <em>MODSECURITY</em> rule (using PCRE) for whitelisting ASP session id key in the cookie header. Here is what came to my mind so far:  </p>
  
  <pre><code>^(?!.*?ASP.NET_SessionId=[a-z0-9]+;.*?$).+  
  </code></pre>
  
  <p>The website cookie header is like this:  </p>
  
  <pre><code>Cookie: PortalAlias=Portal; Language_PostPortal=en-US; ASP.NET_SessionId=opn4y4n1qja0mtzm4sx4514k; portalroles=50FA411EBBAC79
  </code></pre>
  
  <p>So any cookie value with characters except <code>[a-z0-9]</code> in the ASP.NET_SessionId key must be blocked.Is there a best and more optimized regex(PCRE) to do this?</p>