We now know that all comms implant to C2 are TLS with a unique (fake) certificate tree. They use unique, single use domains for operations. I don't believe there was enough information in vault 7 to identify IOC's that could be used for behavioural analysis. We also now know that the C2 fronting servers negotiate 'Client Cert optional', which is a fairly unique configuration item.
The git repo contains 3 binary builds of the client/server malware. I think this is more important for detection than their docs.
Regardless, its all public domain now.
What you're saying comes from the documentation included in the source, yes. But if you dig into the Confluence dump from back in March, you'll see that the User's Guide and Developer's Guide PDFs for Hive were attached to one of the wiki pages already, explaining how this all worked. It did not get any press attention as it was quite mundane compared to the more interesting leaked wiki pages, but I would really hope AV companies and others in infosec noticed this already.