The Windows loader is the operating system component that resolves and maps executable code and DLLs into a process. When an application starts or calls a library, the loader decides where to look, what to load, and in what order. That search logic is essential for normal software behavior, but it also creates security risk if an attacker can place a malicious DLL in a location the program checks before the real one.
In attacks, this is often abused through DLL sideloading: a legitimate executable is launched, the loader finds an attacker-controlled library nearby, and the malicious code runs inside a trusted process. Defenders watch for suspicious DLL search paths, unsigned libraries, unexpected parent-child process behavior, and binaries that load modules from writable directories. Hardening measures include using fully qualified paths, reducing writable locations in search order, enabling safe DLL search modes, and monitoring module loads with endpoint telemetry.