> what's to stop the attacker from distributing their own interpreter that just doesn't use AMSI?

AppLocker https://technet.microsoft.com/en-us/library/ee619725.aspx

(In short, restrict which executables can be run on a particular system by path/certificate/etc.)

Also a combination of ACLs and the fact that they may not be able to copy files onto the system directly anyway - see my post just before yours.