Let’s be honest with ourselves for a minute. The cybersecurity industry still romanticizes the adversary. We picture a guy in a dark hoodie, hopped up on energy drinks, furiously typing commands into a Kali Linux terminal while synthwave plays in the background. We build our detection frameworks around this guy. We assume he makes typos, gets confused by output, and occasionally has to go to the bathroom.
Well, I have bad news. Your new adversary doesn’t need bathroom breaks.
As Anthropic’s recent LLM ATT&CK Navigator research so cheerfully pointed out, the new threat actor is a Large Language Model wrapped in agentic scaffolding. It finds an SSRF vulnerability, extracts your SSH keys, and pivots laterally across your network in the time it takes your Tier 1 analyst to click “Acknowledge” on a phishing alert.
If your detection strategy relies on catching a human making human-speed decisions, you are already obsolete. When Active Scanning (T1595) chains into System Information Discovery (T1082) and Exploitation of Remote Services (T1210) within an 800-millisecond window, you aren’t hunting a human. You’re hunting a machine. And to catch a machine, you need to measure velocity.
Welcome to the Machina Velocity Engine (MVE), the newest feature in the HEFAISTOS platform, built specifically to detect the terrifying speed of autonomous killchains.
The UI: No, You Can’t Have “Minority Report” Drag-and-Drop
Let’s address the frontend first. We could have built a floaty, physics-based drag-and-drop canvas where you pull nodes out of the ether, but we respect your time and your RAM too much for that.
MVE uses a structured, pragmatic “Add -> Select -> Manipulate” workflow built in React. You click to instantiate a node on your canvas, and then you tell it what it is. You pull from two distinct realities:
- Data Catalog (Raw Events): For when you just want to track the raw telemetry dust the agent kicked up (e.g., Sysmon Event ID 11 or an IIS HTTP 200).
- Rule Hub (Native Rules): For when you want to drop in a pre-built, beautifully optimized KQL or SPL logic block.
Once your nodes exist, you wire them together. But here is the magic: you enforce a Velocity Constraint (e.g., max_total_span: 800ms) and lock the entire chaotic sequence to an Anchor Entity (like host.hostname). This ensures the engine is tracking a single, continuous, sub-second rampage, rather than three different users doing three different things at the exact same time.
Capability Abstraction: Because Grepping for IPs is Depressing
We didn’t build MVE just so you could draw pretty flowcharts of IOCs. Every node you drop onto the canvas is strictly tied to our Capability Abstraction Library, which is natively mapped to MITRE ATT&CK.
Why? Because of our validation pipeline.
HEFAISTOS is a detection engineering brain, not a live SOAR execution engine. We are not going to pipe petabytes of live, garbage-tier network telemetry into a shiny new database just to see if your rule compiles. Instead, we use our existing, rock-solid Django, PostgreSQL, and RabbitMQ stack to do something much smarter: retroactive intelligence matching.
When you click “Validate” on your Kinetic Chain, you fire off an asynchronous Celery task. The Django ORM dives into our PostgreSQL database, specifically targeting the structured AdvOps campaign extracts and Analysis of Competing Hypotheses (ACH) data. It looks at your sequence of abstractions (e.g., Component -> Action -> Behavior) and asks the database: “Have we seen an adversary chain these exact capabilities together before?”
If it finds a match, your chain is instantly flagged as “AdvOps Validated,” linking you to the historical campaign. You aren’t just guessing what an AI agent might do; you’re verifying your logic against what threat actors have actually done.
Output: Pouring One Out for the Universal Translator
Now, how do we deploy this?
Here is where we have to have another uncomfortable conversation. The 2010s dream of writing a detection once in a pristine, universally translatable YAML format and magically deploying it everywhere is dead. Trying to force a complex, stateful, sub-second sliding time-window correlation through a generic translator is how you end up with mangled KQL that treats your multi-million-dollar SIEM like a regex garbage dump. We refuse to participate in that charade.
When you finish an MVE chain in HEFAISTOS, we export it directly into an OpenTide YAML blueprint:
YAML
version: opentide/v1.2
kind: VelocityDetection
metadata:
id: MVE-CHAIN-0092
name: "Autonomous Exploit to Lateral Pivot"
author: "HEFAISTOS Workbench"
tags:
- AI-Agent-Activity
- MVE
engine_parameters:
anchor_entity: "host.hostname"
velocity_constraints:
max_total_span: "800ms"
chain_sequence:
- step: 1
type: event
source: data_catalog
capability_abstraction: "CAP-LIB-0042"
tactic_ref: "TA0001"
technique_ref: "T1190"
criteria:
event_category: "web"
http_status: 200
uri_query_contains: "../"
- step: 2
type: rule
source: rule_hub
capability_abstraction: "CAP-LIB-0112"
tactic_ref: "TA0008"
technique_ref: "T1021.004"
rule_id: "NATIVE-LAT-SSH-01"
Notice what is not there? A watered-down, universal translation. OpenTide acts as the architectural blueprint. You push this object to your Git repository, and your CI/CD pipeline deploys it into the native, highly-optimized dialect of your target platform.
We model the intent, the velocity, and the abstraction. Your target platform handles the execution at native speed.
The adversaries have stopped typing. They are orchestrating. It’s time our detection engineering platforms caught up to the velocity of the threat. The Machina Velocity Engine will be available in your HEFAISTOS Workbench in the next release. Go build something fast.
Please note that because we respect your engineering sensibilities too much to ship a finished product, the Machina Velocity Engine is launching in Public Beta. This means it might sometimes miscalculate milliseconds or accidentally identify a particularly enthusiastic script kiddie as a nation-state AI. We reserve the right to totally rework, rename, or deny its existence as needed. Use with appropriate skepticism. Feedback is welcome, provided it’s funny.
Now go build something fast.