[Intel]: https://github.com/eurecom-s3/lemon

### Area

Defensive tools

### Parent threat

Persistence, Defense Evasion

### Finding

https://github.com/eurecom-s3/lemon

### Industry reference

uses:eBPF
attack:T1564:Hide Artifacts
attack:T1014:Rootkit

### Malware reference

_No response_

### Actor reference

_No response_

### Component

Linux

### Scenario

_No response_