Honeypot attack session (period 2021_2022), commands issued:
start
enable
config terminal
system
linuxshell
shell
sh
echo -e '\x65\x70\x6D\x70\x69'
passwd
cd /tmp || cd /var || cd /dev || cd /etc
cat /bin/ls|more
cat /bin/ls|head -n 1
echo -e '\x6E\x64\x79\x6A\x75'

MITRE ATT&CK techniques observed:
T1059 Command and Scripting Interpreter
T1531 Account Access Removal
T1083 File and Directory Discovery
T1005 Data from Local System
T1059 Command and Scripting Interpreter