Can you use too many LOLBins to drop some RATs?

This report outlines a multi-stage infection that abused Windows built-in utilities (forfiles, mshta, PowerShell/curl, tar, expand, WScript, reg) to download and stage payloads and ultimately deploy Remcos and an abused NetSupport Manager client as RATs; the chain used fileless download, staged .PART files in C:\ProgramData, a trojanized glaxnimate executable, and stealthy registry persistence. Malwarebytes reportedly blocked the attacker IP and detected the RATs, illustrating both the threat and existing detection capability.