Does this really happen, or would it ever? Seems like a contrived scenario for employees to have enough access and knowledge to detect and defeat a userspace or kernel-resident solution that doesn’t want to be found. Plus, if you’re going that far, you’d want to make sure it wasn’t easily detectable by analyzing network traffic.

I’m sure such a thing is out there, but I doubt it’s being used by employers to spy on workers. More like governments spying on workers with access to sensitive IP.