Modyfy the following file to remove SNORT/Suricata detections => https://raw.githubusercontent.com/nmap/nmap/master/osscan2.cc
User-Agent will be seen in the packet so lets remove the default
SET => USER_AGENT = stdnse.get_script_args('http.useragent') or "Mozilla/3.0 (compatible; )"
SET => tcp->th_win = htons(9999); /* Who cares */
SET=> tcp_header->th_win = htons(65535); iph->ip_id = htons(54321);