How do you "tell" there was something on kernel level without offline forensics (which means the machine is put of the grid anyways)?

A compromised Kernel can lie to you about everything, including the malware.