AV is now far beyond just using hash-based detection, but you are correct that having the three binary builds will allow that to also be added to their (hopeful

AV is now far beyond just using hash-based detection, but you are correct that having the three binary builds will allow that to also be added to their (hopefully existing) detections. No argument there. What you're saying comes from the documentation included in the source, yes. But if you dig into the Confluence dump from back in March, you'll see that the User's Guide and Developer's Guide PDFs for Hive were attached to one of the wiki pages already, explaining how this all worked. It did not get any press attention as it was quite mundane compared to the more interesting leaked wiki pages, but I would really hope AV companies and others in infosec noticed this already.