diff --git a/pentesting-cloud/aws-security/aws-post-exploitation/aws-kms-post-exploitation.md b/pentesting-cloud/aws-security/aws-post-exploitation/aws-kms-post-exploitation.md
index 34f59cbbf3..3d2c5cd9d1 100644
--- a/pentesting-cloud/aws-security/aws-post-exploitation/aws-kms-post-exploitation.md
+++ b/pentesting-cloud/aws-security/aws-post-exploitation/aws-kms-post-exploitation.md
@@ -25,8 +25,12 @@ For more information check:
 
 ### Encrypt/Decrypt information
 
+```fileb://``` and ```file://``` are URI schemes used in AWS CLI commands to specify the path to local files:
+ - ```fileb://:``` Reads the file in binary mode, commonly used for non-text files.
+ - ```file://:``` Reads the file in text mode, typically used for plain text files, scripts, or JSON that doesn't have special encoding requirements.
+
 {% hint style="success" %}
-Note that if you want to decrypt some data inside a file, the file must contain the binary data, not base64 encoded data.
+Note that if you want to decrypt some data inside a file, the file must contain the binary data, not base64 encoded data. (fileb://)
 {% endhint %}
 
 * Using a **symmetric** key