MySQL LOAD_FILE/INTO OUTFILE Container Escape Probing (docker.sock, /proc)

Duo Tech@duotech

•updated Jul 8, 2026•1•0•2

This rule detects potentially malicious MySQL database operations involving sensitive file access or suspicious data exportation. It monitors for the use of 'INTO OUTFILE' commands pointing to sensitive paths (like /var/lib/mysql-files/) or the use of 'LOAD_FILE' commands to access system files such as /var/run/docker.sock, /proc/1/cgroup, or /proc/1/mountinfo, which are indicative of attempts to exfiltrate database content or escape a container environment.