How do you "tell" there was something on kernel level without offline forensics (which means the machine is put of the grid anyways)? A compromised Kernel can

How do you "tell" there was something on kernel level without offline forensics (which means the machine is put of the grid anyways)? A compromised Kernel can lie to you about everything, including the malware.