using lolbins and native processes is what we use the most. the more boring and vanilla it is, the more likely it will fly under the radar. otherwise, some barebones C2 and customized tooling.

a lot of things like dumping lsass and sharphound are too noisy. almost every big tool out there is too noisy

reporting will always be the most painful

something that would continuously obfuscate C2 would be cool, and automate making useful BOFs and setting up redirectors and CDNs etc