PowerShell runs on every Windows endpoint, every day, for hundreds of legitimate reasons. The threat is never the binary. It is encoded commands, off-baseline timing, unusual scope, and privilege drift on the same primary identity. Vedric reads that context.
Currently supports Windows endpoints.
Blocking PowerShell breaks your environment. Allowing it without context leaves you blind. PowerShell is one of the most useful operational tools on Windows and one of the most abused. Static rules flag either too much, because enterprise IT runs PowerShell constantly, or too little, because malicious patterns look the same as legitimate ones at the binary level. Effective PowerShell threat detection works at the context layer: when the command runs, who runs it, how it is encoded, and how it compares to the user's historical pattern.
The PowerShell binary is signed by Microsoft and clean. Process-tree heuristics catch some patterns and miss most. Without a behavioral baseline, EDR cannot tell that a command is the first time this user has run it in six months.
Once a blocklist exists, attackers Base64-encode, escape, or pipe commands through. Defenders keep adding patterns and end up with a list nobody reviews and false positives nobody fixes.
PowerShell script-block logging is essential, but noisy. Without behavioral correlation, it produces a search index, not alerts.
AMSI is excellent at inspecting script content during execution, but it looks for known-bad content. It does not see when a user's PowerShell use departs from their normal pattern.
Vedric reads command lines, script-block events, encoded arguments, and parent-child process context. It then compares each command to this user, this endpoint, and the user's peer cohort. Most PowerShell threat detection comes from that comparison, not from a regex on the command itself.
Encoded PowerShell is decoded before baselining, and the plaintext command is compared to the historical pattern. An encoded version of a routine command is treated as routine. An encoded one-off is treated as a deviation.
When, who, and how matter more than the command itself. A WMI query at noon by an IT admin is normal. The same query at 03:00 from a finance workstation, by a domain admin who has not run that command in six months, is a storyline. Vedric weights timing, identity, and scope as first-class context.
A PowerShell deviation alone is minor. Correlated with scope drift, privilege drift, or a time anomaly on the same identity, it becomes a storyline. The platform promotes the correlated case and logs the rest without alerting.
The user works in finance and has never used PowerShell beyond what their installed apps invoke. Late on a Thursday evening, an encoded command runs from an unusual parent process.
Static PowerShell rules would have produced either no signal, because the command is not on any blocklist, or noise, because every encoded command would have been flagged. This detection worked because the invocation was off-baseline for this user, at this time, from this parent process.
Vedric is designed to minimize content collection. The agent code enforces the list of refused collectors and the documented, bounded PowerShell exception.
Read the full privacy stanceEarly access is for teams whose PowerShell rules are either too quiet or too loud, and who want behavioral context underneath them instead of more thresholds.