To monitor some file for changes (like /etc/passwd file):

1. Add DCI File.Hash.CRC32(/path/to/file)
2. Create event template (something like "Contents of %6 changed").
3. Add threshold "diff with previous value" (1 sample) not equal (!=) to 0 to generate this event.
4. Don't forget to put file name to Instance field.

This should work fine also for MD5 and SHA1 hashes, as string comparison return -1,0,1, so !=0 will do the same trick.