Typically by things like reaction time, input latency, smoothness of motion, etc. A real human is surprisingly nondeterministic about these things, and their hardware adds all sorts of other interesting noise to the data. A naive aimbot will look unnaturally smooth and linear.

You can somewhat cat-and-mouse this by attempting to humanize the inputs, but it's surprisingly difficult to replicate "natural" motion as input by a human. The humanized aimbot will end up with its own detectable signature. Besides that though, don't let perfect be the enemy of good enough. Catching the low-hanging-fruit (the stuff that is easy to detect) is *most* of the problem. Leave the crazy advanced stuff to the professional leagues, where players are under higher scrutiny anyway.

Mind that I don't meant to argue against clientside cheat detection. You can still do a lot of that in userspace, and you really should. It's more data to analyze and it raises the bar for casuals. But since you inherently can't trust the client, you need to also do serverside detection, and really the serverside stuff (being remote, unknowable, and much harder to exploit) is going to be the stronger signal.