An endpoint device monitors loading of dynamically loaded libraries (DLLs) by a process, such as during execution of the process on the endpoint device. The endpoint device can generate an endpoint-independent representation of the DLLs upon exiting of the process. The endpoint device may generate a hash, such as a one-way hash, of the endpoint-independent representation. The endpoint device may transmits the process and the hash to a management device to detect in a machine learning manner whether loading of the DLLs during the execution of the process was anomalous.