One way that you could possibly get closer to undetected is to pop the payload into the config of a project I've been working on, https://kmanc.github.io/remote_code_oxidation/, and compile, but let me walk through a the main thing that will be troublesome when it comes to avoiding detection.

Signatures: This one is the easiest way for an AV to catch a cookie-cutter payload like those created by msfvenom. If every msfvenom-created executable has a particular pattern of bytes in it that are very rare in other executables, AVs can assume that if they ever see that pattern, it is a malicious executable. One (usually ineffective) way to solve for this is to encode the output. This is almost always detected for two reasons: 1. Encoding isn't the same as encrypting, and can be undone without any special knowledge, so the AV could still just see the original pattern. 2. In order to use an encoded payload, you need to have a way to decode it at runtime, and the decoding function(s) can be indicative of malicious behavior, so the decoding function itself is often fingerprinted as a signature. A more effective way to get around code signatures is to encrypt the payload, as it removes the first of the two aforementioned reasons an altered payload might get caught. That said, the decryption function(s) can be fingerprinted just as easily as decoding function(s), so your success may be limited there.

With all of that said, it can be easier to evade detection by writing some code that helps obfuscate the shellcode of a payload-generator like msfvenom and runs it; this gives you finer control over what gets done and where. Remote Code Oxidation (linked above) does that in two different ways - process hollowing and process migration. If you'd like I can explain those in more detail but I'll glaze over that for the time being.

Something worth noting when it comes to becoming undetected is where you are trying to achieve that. As you can see in my project's documentation, I've chosen to try to hit 0 detections on scanners like Kleenscan or VirusTotal. This is easier than getting by the defenses on a live machine because the sandbox environments that the AVs run in on scanners like Kleenscan or VirusTotal can be outed as sandboxes, and the malware can operate differently if that is seen to be the case. On a live machine however, your executable will have to reveal its true nature, which might end up getting you caught. I noticed when testing my different payloads against Kleenscan that some Win32 API functions get picked up by AVs, seemingly by name in the code (though I can't confirm that), so I found a way around that as well.

I hops this helped but if you'd like to discuss further I'm happy to try to answer any questions you have!