Hash
noun · also Hash function, Cryptographic hash · NIST CSRC Glossary
A fixed-length fingerprint calculated from data, such as a file's SHA-256 value, that changes completely if even one bit of the input changes.
A cryptographic hash function takes input of any size and produces a short, fixed-length value. The same input always gives the same hash, and it is practically impossible to find two different inputs with the same hash or to reconstruct the input from it. That makes hashes ideal fingerprints for files and evidence.
SHA-256, from the SHA-2 family standardized by NIST in FIPS 180-4, is the common choice today. MD5 and SHA-1 are still seen in tools and reports, but both are broken for collision resistance and should not be trusted to prove that two files are different. Password storage is a separate use case that relies on deliberately slow algorithms such as bcrypt, scrypt or Argon2.
Example
An alert flags a file named invoice.exe. Its SHA-256 hash is searched in a threat intelligence platform and matches a known infostealer. The same hash is then searched across all endpoints, revealing two other machines where the file exists under different names.
Why it matters for a SOC analyst
Hashes are the most precise indicator of compromise for files: names and paths change, hashes do not. In forensics, recording the hash of every piece of evidence proves it was not altered later. Remember the limitation, too: changing a single byte gives malware a brand-new hash, so a hash that matches nothing is not proof that a file is safe.
Related terms
- Indicator of compromise
An observable artifact, such as a file hash, IP address, domain or registry key, that suggests a system may have been compromised.
- Digital forensics and incident response
The combined discipline of investigating security incidents with forensic methods while containing and recovering from them.
- Malware
Any software designed to harm a system or its users, such as viruses, worms, trojans, ransomware, spyware and infostealers.
- Threat intelligence
Information about threats and threat actors, collected and analyzed so that an organization can make better security decisions.