HEFAISTOS

Welcome to the Proving Grounds

[ 2026-06-08 // hunt3r ]

Listen up, threat hunters. Welcome to the live-fire beta test of the HEFAISTOS platform. We are feeding the Maieutic engine some fresh, real-world telemetry based on the Operation Dragon Weave campaign. Your objective is simple: execute the workflow, stress-test the Analysis of Competing Hypotheses (ACH) matrix, and validate the detection pipeline.

We are building a proper detection-as-code workbench here, which means we expect native, tactical logic—KQL, SPL, AQL. If you are looking to generate generic, watered-down SIGMA rules, you are in the wrong place. Follow the steps below exactly as written. Break it if you can, but document everything.

Get to work.

First go to Your account (My Profile) and enable “Use Organization AI” and refresh or even better logout / login back.

Task 1: Welcome to HEFAISTOS

Phase 1: The ACH Matrix

  1. Click NEW ANALYSIS.
  2. Enter the name “Dragon Weave Analysis” (or whatever you feel like).
  3. Drop in a description if you want, then hit CREATE.
  4. Click on your newly created ACH name to open it.
  5. Hit ADD HYPOTHESIS and enter: H1: State-sponsored espionage targeting government infrastructure.
  6. Hit ADD HYPOTHESIS again and enter: H2: Cybercriminal syndicate leveraging advanced loaders for future extortion.
  7. Hit ADD EVIDENCE and input: E1: Use of Azure Blob Storage for C2 (select credibility as you see fit).
  8. Add your second piece of evidence: E2: Rust-based loaders, specific targeting of Czech and Taiwanese officials and set the credibility.
  9. Add the final evidence: E3: Hardcoded sandbox evasion lists and set the credibility.
  10. Mess around with the credibility levels—change them from N to whatever. We are testing the application’s plumbing here, not your mental process.
  11. Smash the DEVILS ADVOCATE button and read the output.
  12. Click MARK FINISHED when you are done.

Phase 1a: ACH Matrix (AI Edition)

  1. Click NEW ANALYSIS.
  2. Name it “Dragon Weave Analysis AI” (or your preference).
  3. Add a description if you want, then hit CREATE.
  4. Click the AI Assistant button.
  5. Paste the Operation Dragon Weave scenario text provided earlier (Targeted cyber-espionage, China-linked, Czech/Taiwan targets, T1566.001, DLL side-loading T1574.002, RUSTCLOAK, AZUREVEIL, T1055, Azure Blob Storage dead-drop T1102.001).
  6. Click GENERATE DETECTION HYPOTHESES & EVIDENCE.
  7. Wait for the matrix to render.
  8. Try editing an evidence or hypothesis entry using the pencil icon.
  9. Change the credibility levels from N to test the state management.
  10. Click DEVILS ADVOCATE. It takes a minute to chew on the data, so just read or skim the output when it pops.
  11. Click MARK FINISHED.

Task 2: AdvOps Data Ingestion

  1. Navigate to the WORKBENCH HUB and switch to the ADVOPS tab.
  2. Click NEW HUNT.
  3. Upload the intelligence document or paste the raw Seqrite URL.
  4. Wait for the parsing to finish and click OVERWRITE FORM.
  5. Verify that all data fields are populated correctly.
  6. Click SAVE.
  7. Re-open the hunt by clicking the name or EDIT.
  8. Click + WORKBENCH and wait for the “SUCCESS” message to populate.
  9. Close the dialog window.

Task 3: The Workbench Pipeline

  1. Go back to the WORKBENCH tab on the WORKBENCH HUB page (refresh the page if your new workbench doesn’t instantly appear).
  2. Click on your newly minted workbench.
  3. Change the name to “Dragon Weave Detection” or whatever suits you.
  4. In Part 1: MITRE ATT&CK Technique, enter T1566.001 and select it.
  5. Click on DET0236 Detection Strategy… to expand the Analytics section.
  6. Pick any Analytic and click USE LOGIC. The Analytic Log Level on the right must change, and “Level 3: Moderate (Artifact)” should appear under the strategy title.
  7. The LIVE section should expand to show Data Components. Click any or all + ADD buttons and check for success/fail notifications.
  8. Scroll down to Part 3: Detection Rules and ensure the command-line table is populated.
  9. Scroll back up to the Response Playbook section and click AI ASSIST to automatically populate response steps.
  10. Scroll back to Part 3: Detection Rules and hit the MULTI-PLATFORM EDITOR.
  11. Click GENERATE WITH AI. The platform will ingest your inputs and spit out a rule. Give it a minute.
  12. Check the INSIGHTS tab for suggestions and choose either Load quick-win variant or Load robust variant. The content must swap out accordingly.
  13. Verify the Insights are populated after the rule generates. Feel free to mess around with SPL, WAZUH, QRadar, “SUGGEST IMPROVEMENTS”, or “GENERATE SIMILAR”.
  14. Click SAVE KQL.
  15. Head down to Part 6: Review Workflow.
  16. In NOTES FOR REVIEWER, type something useful like “Rule done, tested.”
  17. Smash SUBMIT REQUEST.

End of Exercise

If you made it to this point and successfully pushed your rule to the review workflow without the platform crashing, congratulations. Your telemetry has been logged, and the data is exactly what we need to harden the application before we eventually plug ORION into the backend to handle the coverage gap analysis.

Drop your bug reports, log any UI friction, and go pour yourself a coffee. Good hunting.