A hash indicator is a short unique string, usually produced by a cryptographic hash function such as SHA-256, that identifies a specific file, message, or post. If the underlying content changes even slightly, the hash changes too. In security records, a hash can act as an identifier for a sample, an attachment, or a claim post when the original item is unavailable or redacted.
Hash indicators matter because they let defenders match the same object across logs, threat feeds, sandbox reports, and case notes. Analysts use them to spot known malware, confirm whether two files are identical, and block or quarantine malicious artifacts. In real attacks, criminals may post or share hashes to reference stolen data or malware, while defenders treat the hash as evidence to correlate activity. A hash is useful for identification, but by itself it does not prove compromise or explain impact.