Without going too much into specifics (as they're very dependent on the circumstances of the test), you could think about things like this.
How do SOCs find attackers? Well there's a couple of ways, they might look for the signatures of known attack tools, so for example most IDSs will have a signature for nmap scanning, and if you scan using nmap you'll set that off.
Another way that the blue team could work is that they look for anomolies. So for example if they know that there's no service on the network using Port 23455/TCP and suddenly they start seeing traffic on that port, it's easy to use that as an alertable event.
So from the attacker perspective, how do you avoid that?
Well for the first one, avoid using well known tools in their default configurations. Instead of nmap try using things like operating system tools that let you connect to services (so for example an SSH client in a loop looking for SSH servers)
Also make use of techniques that are passive. Packet sniffing might reveal systems broadcasting traffic which gives away what services they are running. So for example, a Windows server may make certain broadcasts that you can pick up. so then you know what it is and you can directly contact it on the common Windows ports, which likely won't show up on a SOC dashboard as that's pretty normal traffic.
The other thing to avoid is common default ports for attack tools. If the tool ships with a default, use something else and preferrably something which is already in use on the network, like using 443/TCP for SSL traffic, that'll blend in quite well, in all likelihood.