Overview
File hashes identify specific files as IOCs. This lesson covers hashes as indicators.
Learning objectives
- Explain file hashes as IOCs.
- Describe their strengths and limitations.
- Connect hashes to malware detection.
Core concept
A file hash (from the cryptography lessons — a fixed-length fingerprint of a file's contents, e.g. SHA-256) is an IOC that identifies a specific file exactly: if a file's hash matches a known-malicious hash, it is that known-bad file. Hashes are high-confidence indicators — a match is precise, not coincidental. Their key limitation is that any change to the file (even one byte) produces a completely different hash, so attackers easily evade hash-based detection by making trivial modifications (polymorphism). Thus hash IOCs reliably catch known malware samples but miss modified/novel variants — making them precise but narrow, best combined with behavioral detection.
How it works
As an IOC, a file hash is matched against hashes of files seen on endpoints (via EDR/antivirus telemetry): a match to a known-malicious hash confidently identifies that exact malicious file present in the environment. Because a hash uniquely fingerprints file contents, a match is essentially certain (extremely high confidence) — a major strength. The weakness is brittleness: changing the file at all yields a totally different hash, so attackers trivially produce variants (repacking, minor edits) that evade a specific hash IOC. Hence hash matching catches known samples exactly but not modified or new ones. This is why hashes complement — rather than replace — behavioral detection (module 8) that catches malicious behavior regardless of the specific file. Different hash algorithms exist; using a strong one (e.g. SHA-256) avoids collision concerns. Hash IOCs are a precise, high-confidence but narrow tool.
Practical example
Threat intelligence provides the SHA-256 hash of a known malware sample. The SOC matches it against endpoint file hashes and finds the exact file present on a host — a high-confidence detection of that known malware. In a later incident, the attacker used a slightly modified version of similar malware; its hash didn't match the known one, so hash-based detection missed it — but behavioral detection (unusual process activity) caught it. The pair shows hashes as precise, high-confidence indicators for known files, and why they're combined with behavioral detection to catch variants.
Cybersecurity relevance
Hashes are high-confidence, precise IOCs — a match uniquely identifies a specific known-malicious file (via its cryptographic fingerprint), essentially certain rather than coincidental. Their limitation is brittleness: any file change yields a completely different hash, so attackers easily evade hash detection with trivial modifications — meaning hash IOCs catch known samples but miss modified/novel variants. This is precisely why they complement behavioral detection (module 8), which catches malicious behavior regardless of the file. Hash matching (via EDR/AV telemetry) is a core, reliable-but-narrow part of IOC analysis and malware detection, and reinforces the cryptographic-hash concepts from earlier paths.
Common mistakes
- Relying on hash IOCs alone, missing modified/novel malware variants.
- Not pairing hash detection with behavioral detection.
- Using weak hash algorithms (collision risk) instead of strong ones like SHA-256.
Key takeaways
- A file hash is a high-confidence IOC that identifies a specific file exactly; a match to a known-malicious hash confidently detects that known-bad file.
- The limitation is brittleness: any file change yields a totally different hash, so attackers easily evade hash detection — hashes catch known samples but not variants.
- Hashes complement behavioral detection (which catches behavior regardless of file); hash matching via EDR/AV telemetry is a precise-but-narrow part of IOC analysis.
Check your understanding
- Why are hash IOCs high-confidence, and what is their key limitation?
- Why must hash-based detection be combined with behavioral detection?