A new feature called Antimalware Scan Interface, that allow AVs to 'see' Powershell commands executed, was introduced in Powershell v5.
According to adsecurity, this feature seems to rely on the system-wide System.Management.Automation.dll
assembly:
When code is delivered to the PowerShell “engine” (System.Management.Automation.dll), it is sent to the AMSI for anti-malware checks.
Does that mean AMSI would not work if a PowerShell script is executed from an embedded System.Management.Automation.dll
assembly into an executable?