Burp Suite Professional is a tool for approved tests, or for labs -- not for red-team engagements or cyber exercises. Typically, a cyber exercise is going to include exploit-only code where the exploitability of each vulnerability is well-known and pre-tested.
When you look at exploit code, such as the ones targeting Cisco PIX and ASA firewall platforms -- the codenames and modularization are focused entirely on known, categorized exploits as late attack-cycle specialized weapons -- not as early-on testing all-purpose software-quality tools.
Even the metasploit-framework is losing its relevance, including its evolving Meterpreter implant. It is rare to hear of real threat actors using metasploit-framework components -- I have only heard about India-based threat communities using it for high-profile attacks.
Probably the most-common red-team engagement tool for stealth is PowerSploit. Instead of bypassing or using an unrestricted PowerShell ExecutionPolicy, typically modules and assemblies will be signed. Using a custom or slightly-modified compression or encoding approach, PowerShell can be easily obfuscated and even ConstrainedLanguage and AMSI bypassed. Posh-SecMod has some examples of script compression through the Compress-PostScript and New-PostDownloadExecuteScript functions.
PowerShell and C# provide a lot of low-profile attack paths. If you are interested in XSS, SQLi, or similar attacks from these easy-to obfuscate frameworks, be sure to check out the book, Grey Hat C#. Many of the stealth-oriented attack techniques are available in PowerView because Microsoft Windows Server Forest technology isn't widely monitored by orgs, nor are any of the Active Directory elements -- especially not AD objects that relate to Microsoft DNS or SPN identifiers.
If an exploit can reach memory (e.g. client-side or service-process layer), such as through a Flash, Internet Explorer, or office-document exploit -- a red team can leverage the ReflectivePick technique outlined in the links in the third paragraph of this answer (N.B., especially see the one on alternatives to Meterpreter).
Many attacks can leverage the TLS protocol for stealth, including SQLi. If you want to tunnel through a web framework such as ASP.NET or Java Enterprise, be sure to check out APBTTS, which will provide the transport-layer capabilities of a web shell without writing a web shell to the disk.
Specific, other defensive-technology bypasses (or theories that could certainly lead to new techniques) can likely be found in books such as The Anti-Virus Hacker's Handbook.
