What we do is we register an AMSI provider and that's it. The operating system itself decides when and what processes the provider will be loaded into. Despite the eamsi.dll being signed with a MS signature, it cannot be loaded into all processes; svchost.exe seems to be one of the exceptions and the OS protects it from any 3rd party dll being loaded into it regardless of signatures.