Hash-based detection identifies a file by its cryptographic fingerprint, or hash. Because a hash changes when the file changes, this method is most effective for known, unmodified malware samples. Security tools use hashes to block specific malicious files, speed up triage, and share threat intelligence in a compact form.
Its weakness is that attackers can evade it by altering the file, repacking it, or generating a fresh variant for each victim. In modern malware delivery, a browser, installer, or script may assemble a new payload on the fly, producing a different hash every time. That makes simple blocklists less reliable and pushes defenders toward behavioral detection, file lineage, and process monitoring. Hash-based detection remains useful, but it works best as one layer in a broader defense strategy rather than as the only control.