The md5, sha1, sha256, sha384, and sha512 functions all behave the same way. The only way they differ is in the actual cryptographic hash function used. These functions will calculate the message digest of a field value for use in a filter using any of the comparison operators.
The parameter to these functions is a field name.
For example:
md5(class) = "098f6bcd4621d373cade4e832627b4f6"
Result: would return only results that included a class where the MD5 hex digest of the value was exactly equal to 098f6bcd4621d373cade4e832627b4f6.
Note
These functions are supported in both search and rules.