Module integrity is the practice of verifying that executables and loaded libraries are the approved, expected versions. In Windows environments, that usually means checking file hashes, digital signatures, paths, permissions, and whether a process has loaded an unexpected DLL. The goal is to make sure trusted software is actually running trusted code.
This matters because many attacks hide behind legitimate processes. In DLL side-loading or file-path hijacking, a normal program can be tricked into loading a malicious library from a writable folder. If defenders monitor module integrity, they can spot a signed application that has loaded the wrong file, even when network traffic is quiet. Good defenses combine allowlists, application control, module-load telemetry, and regular inventory checks to detect tampering before it becomes persistence or execution.