public ObfuscationEngine(GeneratedStrings generatedStrings)
{
this.RandomizeText = false;
this.rand = new Random();
this.Rulesets = new List<Ruleset>();
// Mimikatz Rules
Ruleset mimikatz = new Ruleset { Name = "Mimikatz", Type="PowerShell", FileName = "invoke-mimikatz.ps1", Rules = new List<Rule>() };
mimikatz.Rules.Add(new Rule { Name = "'-mimikatz' Replace", Type = "replace", Trigger = "-mimikatz", Action = "-#RANDOM" });
mimikatz.Rules.Add(new Rule { Name = "' mimikatz' Replace", Type = "replace", Trigger = " mimikatz", Action = " #RANDOM" });
// General Rules
Ruleset general = new Ruleset { Name = "General", Type = "PowerShell", FileName = "#ALL", Rules = new List<Rule>() };
general.Rules.Add(new Rule { Name = "Variable Radomization", Type = "ReplaceList", Trigger = @"(\$)[A-Za-z\d]+\b", Action = "$#RANDOM" });
// C# Rules
Ruleset psaSource = new Ruleset { Name = "PSAttack", Type = "SourceCode", FileName = "#ALL", Rules = new List<Rule>() };
string psaReplace = PSABTUtils.RandomString(this.rand.Next(6,15), this.rand);
generatedStrings.Store.Add("psaReplacement", psaReplace);
string attackStateReplacement = PSABTUtils.RandomString(this.rand.Next(6, 15), this.rand);
generatedStrings.Store.Add("attackStateReplacement", attackStateReplacement);
string psparamReplacement = PSABTUtils.RandomString(this.rand.Next(6, 15), this.rand);
generatedStrings.Store.Add("psparamReplacement", psparamReplacement);
psaSource.Rules.Add(new Rule { Name = "'PSAttack' Replace", Type = "replace", Trigger = "PSAttack", Action = psaReplace });
psaSource.Rules.Add(new Rule { Name = "'PS>Attack' Replace", Type = "replace", Trigger = "PS>Attack", Action = psaReplace });
psaSource.Rules.Add(new Rule { Name = "'attackState' Replace", Type = "replace", Trigger = "attackState", Action = attackStateReplacement });
psaSource.Rules.Add(new Rule { Name = "'psparam' Replace", Type = "replace", Trigger = "psparam", Action = psparamReplacement });
psaSource.Rules.Add(new Rule { Name = "'psaLogos' Replace", Type = "replace", Trigger = "psaLogos", Action = PSABTUtils.RandomString(this.rand.Next(8, 14), this.rand) });
//this.Rulesets.Add(mimikatz);
//this.Rulesets.Add(general);
this.Rulesets.Add(psaSource);
}