As the attacker provides first supply, they frequently use indigenous tools PowerShell, WMI, regsvr32, etc