PowerShell is the language. Context is the threat.
PowerShell runs on every Windows endpoint, every day, for hundreds of legitimate reasons. The threat is never the binary. It is encoded commands, off-baseline timing, abnormal scope, and privilege drift on the same primary identity. Vedric reads that context.
THE PROBLEM
Blocking PowerShell breaks your environment. Allowing it without context is blind.
PowerShell is one of the most useful operational tools on Windows and one of the most abused. Static rules either flag too much (enterprise IT runs PowerShell constantly) or too little (the actually-malicious patterns are indistinguishable from legitimate ones at the binary level). Real PowerShell threat detection happens at the context layer: when the command runs, who runs it, how it is encoded, and how it compares to the user historical pattern.
Why PowerShell rules age into noise.
The signed Microsoft binary is, of course, signed and clean. Process-tree heuristics catch some patterns and miss most. Without behavioral baseline, the EDR cannot tell that this PowerShell command is the first time this user has run it in six months.
Once a blocklist exists, attackers Base64-encode, escape, or pipe through. Defenders who keep adding patterns end up with a list nobody reviews and false positives nobody fixes.
PowerShell script-block logging is essential, and noisy. Without behavioral correlation it produces a search index, not an alert surface.
Excellent at script-content inspection during execution. Fights a known-bad battle. Does not see the off-baseline shape of how this user normally uses PowerShell.
Context first. Command second.
Vedric reads command lines, script-block events, encoded arguments, and parent-child process context. Then it asks: how does this compare to this user, this endpoint, and this user peer cohort? Most PowerShell threat detection is the answer to that comparison, not a regex on the command itself.
Decoded and compared
Encoded PowerShell is decoded before baselining. The plaintext command is what gets compared to historical pattern. An encoded equivalent of a routine command is treated as routine; an encoded one-off is treated as the deviation it actually is.
When, who, and how matters more than what
A WMI query at noon by an IT admin is normal. The same query at 03:00 from a finance workstation by a domain admin who has not run that command in six months is a storyline. Vedric weights timing, identity, and scope as first-class context.
PowerShell as one axis among several
A PowerShell deviation alone is a footnote. PowerShell deviation correlated with scope drift, privilege drift, or a temporal anomaly on the same identity is a storyline. The platform promotes the correlated case and quietly logs the rest.
EXAMPLE SCENARIO · TIMELINE
An encoded command on a finance workstation.
The user is a finance employee who has never used PowerShell beyond what their installed apps invoke. Late on a Thursday evening, an encoded command runs from an unusual parent.
- T+01T+01 - endpoint baseline shows zero direct PowerShell invocation in this user historical pattern.
- T+02T+02 - encoded PowerShell launches from a parent process that is not on the user normal toolset. Decoded; baseline mismatch logged immediately.
- T+03T+03 - same workstation begins network calls to a destination not in the user historical destination set.
- T+04T+04 - multiple correlated deviations on the same identity within minutes: encoding shape, parent process, and egress destination. Storyline materializes at high confidence.
- T+05T+05 - Vedric AI triage produces a verdict: critical. Tool calls retrieve the user baseline, peer baseline, recent forensic trail, and historical PowerShell shape. Recommended action: isolate session.
- T+06T+06 - admin reviews and approves isolation. Audit trail records the storyline, verdict, tool calls, and admin response with stated reason.
Static PowerShell rules would have generated either zero signal (the command itself is not on any blocklist) or noise (every encoded command would have flagged). The detection landed because the off-baseline shape of the invocation (on this user, at this time, from this parent) was the actual signal.
PowerShell read in context, not in isolation.
- Decode encoded PowerShell before baselining and storyline correlation
- Compare commands to per-user, per-endpoint, and per-peer historical patterns
- Correlate PowerShell deviations with scope, temporal, and privilege drift
- Tenant-isolated AI triage with read-only tools that surface relevant context
- Append-only audit trail of every PowerShell-driven storyline and response
- Block PowerShell binaries or maintain a static command blocklist as the primary control
- Capture script content beyond what is needed for command-level metadata
- Treat encoded PowerShell as automatically malicious; encoding is one signal among several
- Take action against an endpoint without admin approval and a stated reason
- Replace EDR; many teams use Vedric storylines to enrich EDR alerts
No keystrokes. No screenshots. No file contents.
Vedric is metadata-only by design. The collector enforces these limits at the source code of the agent.
Read the full privacy stance →- No keystrokes
- No screenshots
- No webcam
- No microphone
- No file contents
- No private messages
Questions buyers ask first.
PowerShell signal that does not rot into noise.
Early access is for teams whose PowerShell rule set is either too quiet or too loud, and who want behavioral context underneath instead of more thresholds.