A Windows library file that processes load. In advanced hunting, these loads show up as image-load events for the device.
Also called dynamic-link library.
In the Ultra Transcenders books
Each book explains DLL in context, with comparison tables and the common traps.
Terms in this definition
- ELT
Extract, load, transform: raw data lands in the target system first and is transformed there. See ETL for the opposite order.
- Advanced hunting
Threat-hunting feature of the Microsoft Defender portal that runs KQL over 30 days of raw Defender XDR data, plus onboarded Sentinel data, and supports custom detections. It finds activity after it happens rather than blocking it.
Related terms
- PE
Portable executable, the Windows format for files like .dll and .exe. On Windows, Defender for Endpoint file indicators only apply to this file type.