With each new tool that pops up on the Internet, there's a/v signature written within the very near future of its birth to detect and remove it. For example, PowerSploit's PowerView which is described as: "a PowerShell tool to gain network situational awareness on Windows domains." Technically, there's nothing malicious about this tool as far as I can tell other than its purpose is primarily used for hacking. When downloaded to a system with endpoint protection, the PowerView script is immediately removed.
Not that I've looked under the PowerView hood but I can imagine it's making calls to existing commands and presenting the output to us. I'm a huge proponent of living off the land because we're using the system against itself and as far as endpoint protection, we'll go unnoticed. That's not to say that alerts aren't written for PowerShell execution but that's a separate issue.