> For the complete documentation index, see [llms.txt](https://www.ired.team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.ired.team/offensive-security/defense-evasion/t1158-hidden-files.md).

# Hidden Files

## Execution

Hiding the file mantvydas.sdb using a native windows binary:

{% code title="attacker\@victim" %}

```csharp
PS C:\experiments> attrib.exe +h .\mantvydas.sdb
```

{% endcode %}

Note how powershell (or cmd) says the file does not exist, however you can type out its contents if you know the file exists:

![](/files/-LIRzAgmoyr76o736RRL)

Note, that `dir /a:h` (attribute: hidden) reveals files with a "hidden" attribute set:

![](/files/-LIRzl7yyyIiUId6a7O-)

## Observations

As usual, monitoring commandline arguments may be a good idea if you want to identify these events:

![](/files/-LIS-Bz4i13BhbDRHKLO)

## References

{% embed url="<https://attack.mitre.org/wiki/Technique/T1158>" %}