What patterns does a signature based anti-virus look for?

Most antivirus solutions use a variety of techniques to identify malware.

The simplest (and oldest) approach is to use signatures of known malware such as MD5/SHA1 hashes, or specific strings in binaries. This technique worked more successfully with older malware which didn't have the number of variants we see today.

Next we have heuristic static analysis. This works by scanning files and looking for suspicious features such as packers, obscured code, specific library imports, etc. You could say this is the closest to the "patterns" you are talking about. One could write malware and tweak it until it isn't detected by the most common malware heuristics. These patterns and algorithms are closely guarded secrets of each antivirus vendor and they are unlikely to share them beyond generic explanations.

The last form of malware identification is through dynamic heuristic analysis. This is when malware is run in a sandbox, and the antivirus looks at what the software does. It looks at the libraries it calls, the actions it performs, whether it tries to hide itself, if it makes registry entries etc. There are lots of ways to avoid identification through dynamic analysis which are too in depth for this answer, suffice it to say that it can by bypassed.

TL;DR Nobody can tell you exactly what the patterns are for each antivirus program. There are some generic things they all look for, but the specifics are secrets.

A fruitful line of enquiry for this would likely be to look at how other A-V evasion frameworks handle the problem. AFAIK AV vendors don't make it totally open what they look for and this is likely to vary vendor to vendor.

Veil Framework is one recent example of bypassing A-V, also AVoid, also see this post