Every threat this demo can inject, and how each one actually works

Aegis simulates a security operations centre. Clicking Inject replays a scripted attack as sensor telemetry — no malware, no exploit code, nothing executes. This manual documents each detection rule the demo can raise: what the technique is, how it looks on the network, how an attacker engineers it, and exactly which file in the repo turns it into an incident.