While the attacker has initial availableness, they often times play with indigenous tools PowerShell, WMI, regsvr32, etc