
DNS tunneling for data exfiltration
Evasion of EDR by disabling services (requires privilege) - Stop or modify EDR services; high blast radius and noisy.
Business logic flaws
Only allow Port 179 traffic from the specific IP addresses of known peering partners.
Go practice. Break things (ethically). And always keep HackTricks in your back pocket.