TL;DR - The schema needs a new activity class to represent script execution events. Most Windows EDR products provide visibility into the execution of PowerShell, Python, VBScript, JavaScript, Office ...