MySQL LOAD_FILE container-escape probing of docker.sock and /proc/1/cgroup

Duo Tech@duotech

•updated Jul 8, 2026•1•0•5

Detects execution of processes using 'LOAD_FILE' (often associated with MySQL or specific command-line utilities) to attempt to read sensitive container-related paths such as '/var/run/docker.sock' or '/proc/1/cgroup'. This behavior is indicative of an attacker attempting to gather information for container escape or environment reconnaissance.