Here's my sanitized list of toys and stuff used in CTFs.
C2: Empire
Useradd Service. Privexec Service. Multiple beacons (C/GO)
C2: ThunderStorm
Userland Hooking (and Rickroll). Useradd Service. Privexec Service. Golang Beacon (I was lazy this time).
C2: ThunderStorm
Userland Hooking. Useradd Service. PrivExec Service.