MySQL INTO OUTFILE/LOAD_FILE Filesystem Probing (/etc/hostname, /proc/1/mountinfo)

Duo Tech@duotech

•updated Jul 8, 2026•2•0•1

Detects potentially malicious activity involving MySQL processes, specifically focusing on the creation of files within the /var/lib/mysql-files/ directory, use of SQL 'INTO OUTFILE' for file output, or the use of 'LOAD_FILE()' to read sensitive system files like /etc/hostname or /proc/1/mountinfo, often indicative of SQL injection exploitation or unauthorized data access.