The text 87a580caa318, as Debian 12 (Bookworm) shipped it.
use regular expression search rule
ausearch_add_regex(3) on Linux now
