1. A computer-implemented method, comprising: receiving one or more characteristics of a kernel data structure of an operating system kernel executing on a computer system, the one or more characteristics associated with a configuration of one or more fields of the kernel data structure, the configuration indicating a modification of the kernel data structure; determine, by scanning a plurality of memory pages of the computer system, that a memory page of the plurality of memory pages includes the one or more characteristics; and determining that the memory page includes the modification, and that the modification is unauthorized, by at least: determining that a subset of the kernel data structure is copied to the memory page; and determining that the computer system includes one or more executable instructions that, upon execution by the computer system, access the subset of the kernel data structure.