@Tom Sage, it is definitely possible to recursively search hidden folders using the

file

table. Though generally speaking these recursive searches are pretty hit or miss, as they quickly run into issues with symlink loops. I would try running the following query to see if you can get the contents of your desired directories:

select * from file where directory LIKE '/tmp/.%%';

or if you know the exact directory the file will be contained in (such as your

/tmp/.test

example) :

osquery> select * from file where directory LIKE '/tmp/.test%%';
      path = /tmp/.test-hidden/.hidden-test-file
 directory = /tmp/.test-hidden/
  filename = .hidden-test-file
     inode = 175293577
       uid = 502
       gid = 20
      mode = 0644
    device = 0
      size = 27
block_size = 4096
     atime = 1560452088
     mtime = 1560451946
     ctime = 1560451953
     btime = 1560451946
hard_links = 1
   symlink = 0
      type = regular