The AV should detect the code I'm using to maintain persistence as malware, no? When I change permissions on a section of memory so I can inject into a process

The AV should detect the code I'm using to maintain persistence as malware, no? When I change permissions on a section of memory so I can inject into a process it should pick it up, right? What about the driver I uploaded and installed to do it? After all, any AV worth it's salt does disk and memory scans.