Honeypot attack session (period 2021_2022), commands issued:
enable
development
system
shell
sh
runshellcmd
linuxshell
start start-shell
start-shell
start-shell bash
ping ; sh
vshell
exec shellconfig 
config terminal
busybox DNXFCOW
/bin/busybox DNXFCOW
/bin/busybox cat /bin/busybox || while read i; do /bin/busybox echo $i; done < /bin/busybox || /bin/busybox dd if=/bin/busybox bs=22 count=1

MITRE ATT&CK techniques observed:
T1059 Command and Scripting Interpreter
T1016 System Network Configuration Discovery
T1059 Command and Scripting Interpreter
T1005 Data from Local System
T1027 Obfuscated Files or Information
T1059 Command and Scripting Interpreter