Detecting Agentic Threats in Claude: Writing Rules on the Execution Layer

Detections for Claude on the execution layer: Sigma rules and a correlation runner that catch permission bypasses, rogue MCP servers, and more.