Msagent.sys

QUICSILVER runs its C2 over QUIC, and most port-443 inspection is scoped to TCP

Seqrite's Myanmar campaign hides a Go backdoor's traffic in UDP 443, with a single HTTP request in the whole chain. The monitoring gap travels regardless of your threat model.