From 32264ad7e76e0b39f8559a63baea8fb000c3cbd9 Mon Sep 17 00:00:00 2001
From: Ali Nikkhah <147882318+einlamye@users.noreply.github.com>
Date: Tue, 6 Jan 2026 08:09:58 -0800
Subject: [PATCH] Update install_windows.md

Add the sha256 as the algorithm which sysmon is capable of calculating
---
 chapters/install_windows.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/chapters/install_windows.md b/chapters/install_windows.md
index 5ada64d..2142aa6 100644
--- a/chapters/install_windows.md
+++ b/chapters/install_windows.md
@@ -138,7 +138,7 @@ We can control the hashing algorithm used for events that hash images and we can
 The hashing algorithm or combination of them can be specified with the **-h \<sha1\|sha2\|md5\|imphash\|\*\>** The specified algorithms will be used to hash all images.
 
 ```shell
-sysmon.exe -i -c -h <sha1|sha2|md5|imphash\|*>
+sysmon.exe -i -c -h <sha1|sha2|sha256|md5|imphash\|*>
 ```
 
 We can specify checking to see if certificates are revoked using the -r parameter.