Custom IOA can’t touch these techniques – anyone actually solved this?

Been running a BAS tool against a Falcon estate for a few weeks, writing Custom IOA rules for whatever comes back “not prevented.”
Native binaries were easy. net.exe, schtasks.exe, bitsadmin, wevtutil, sc.exe – all show up clean in the command line. Write a Process Creation rule, kill it, done. ~30 rules in, that part’s solved.
Then I hit a wall. Curious if anyone’s actually cracked this.
The pattern: anything running as encoded PowerShell (-EncodedCommand) or via -File script.ps1. CrowdStrike just sees “powershell.exe -enc <base64>”. Whatever the script does never shows up in CommandLine, so any IOA keyed on command line content is dead on arrival.
A few that got me:

Raw TCP/Telnet C2 – PowerShell TcpClient over loopback. No network IOA catches loopback anyway, and the command line’s encoded too. Dead end from both sides.
Outlook macro downgrade + VbaProject.OTM drop – by the time a File Creation rule fires and kills the process, the registry value and the file are already written. Kill happens, artifact still exists. Reads as not prevented either way.
PSReadLine history suppression – same story, encoded, invisible.
Winlogon Userinit via Set-ItemProperty – PowerShell native cmdlet, not reg.exe. No separate process to catch even if visible.
Bigger picture: Custom IOA only sees 4 things. Process Creation, File Creation, Network Connection, Domain Name. No registry rule type at all. For anything PowerShell-wrapped, you’re betting the command line is plaintext. In my experience that’s maybe 50/50.
What I’ve tried so far, none of it feels like a real fix:
1. Script-Based Execution Monitoring (AMSI) in the prevention policy – sees decoded script body instead of launch command. Haven’t fully validated it catches all of the above yet.
2. Accept detection-only, lean on Fusion/RTR for cleanup after the fact. Doesn’t help “prevented” status but at least remediates.
3. IOA on the -enc flag itself – technically works but kills every legit admin script too. Not doing that broadly.
Anyone gotten AMSI-based prevention to actually close these gaps, not just detect-and-hope? Or does everyone just write this off as a Custom IOA blind spot and handle it elsewhere in the stack?
Not looking for “just enable AMSI” – I know that’s the direction. More interested if it’s actually working in practice.