sure, IOC monitoring can be done via osquery (free), or tanium ($$$). You just have to build your own ruleset to pickup IOCs. Linux has AV, and nextgen stuff like Cylance (works but super buggy, runs as a kernel module). You also have other HIDS, like bro, snort, and so on, but those mostly look for suspicious network traffic. Microsoft OMS has been making some plays here, it frequently flags unusually process execution for me (eg: Python running from an uncommon path or some such)

I don't think that it makes sense in a technical point of view to try to observe something if an attacker has already compromised your kernel. As soon as this happens, there is nothing you can do, which is foolproof as long we don't have kernels which are separating privileges within the system. If you want to observer something you have to depend on a trust anchor. In most today systems you don't have a trust anchor when the kernel is compromised.

for production systems you could run the kernel under an apparmor profile. also mentioned in this awesome talk[1]

[1] https://www.youtube.com/watch?v=346WmxQ5xtk

Yara is used to find file system artifacts https://virustotal.github.io/yara/

Let me introduce you to ossec and syslog/rsyslog/syslog-ng along with the newfound power of systemd and some gpg fun, with a side of nftables.