I hate to be an apologist, but MD5 is the norm in IOCs for two reasons: 1) All of the tools expect and produce MD5 because it is the convention. Computing MD5

I hate to be an apologist, but MD5 is the norm in IOCs for two reasons: 1) All of the tools expect and produce MD5 because it is the convention. Computing MD5 hashes of every file on disk or passing through a network is a relatively common forensic operation right now, SHA256 is not. 2) IOCs are not intended to be used in scenarios in which a malicious collision presents a problem (no one would want to... mask their malware to still look like malware?) so there is little downside to carrying on the convention. While I would recommend against MD5 in most modern applications, if nothing else to avoid having discussions like this all the time, before upsetting an entire ecosystem of tools it is important to consider whether or not the known weaknesses of MD5 actually pose a problem. In this case, a matching hash is the bad state, and so there is no real impact of a preimage attack.