Research
Written at the level of how a class of detection works — not which rule fires on which value in our own products. Vendors who publish their signatures are publishing a checklist for the other side.
When you cannot inspect a process, you still have timing, input and call sequence. What that leaves you with is statistical — and why that is a feature, not a compromise.
Serials, UUIDs and firmware tables can all be rewritten. Keeping them consistent with each other is much harder than faking any one of them, which is where detection gets its footing.