Get-FileHash

Get-FileHash computes the cryptographic hash of a file — PowerShell’s native answer to `certutil -hashfile`, sha256sum, and friends:

Get-FileHash -Algorithm SHA256 C:\path\to\file.exe

Omit -Algorithm and it defaults to SHA256. Supported algorithms: SHA1, SHA256, SHA384, SHA512, MD5 — plus (on .NET 8+ / PowerShell 7.4+) SHA3-256/384/512. Get-Help Get-FileHash on a given host shows what that build supports. It accepts pipeline input of paths and a -InputStream variant for hashing arbitrary streams.

Uses on both sides

• Defense / IR: verify tool integrity, match binaries against known-good hashes, sweep a host for an IOC hash list.
• Offense: check whether a dropped payload was mangled in transit (encoding/proxy damage), confirm tool versions against expected hashes, and avoid IOC-listed hashes by re-packing until the hash changes (trivial — hashing is content-addressed, so any mutation gives a new identity; this is exactly why hash-based detection is weak and behavior-based detection exists; cf. amsi-bypass).
• CTF/forensics: quick integrity checks of evidence images and downloaded artifacts.

Related

• get-help — Get-Help Get-FileHash enumerates supported algorithms on the host
• windows-reconnaissance-commands — situational-awareness command toolkit
• powershell-base64-encoding — neighboring PowerShell data-shuffling trick

Sources

• Microsoft Learn — Get-FileHash