Honeypot attack session (period 2021_2022), commands issued:
cat /proc/cpuinfo | grep name | wc -l
echo -e "taoyao\n4r8bJs2S6i8D\n4r8bJs2S6i8D"|passwd|bash
Enter new UNIX password: 
echo "taoyao\n4r8bJs2S6i8D\n4r8bJs2S6i8D\n"|passwd
cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
ls -lh $(which ls)
which ls
crontab -l
w
uname -m
cat /proc/cpuinfo | grep model | grep name | wc -l
echo -e "concretyourdev\nOe1ysR67H3YU\nOe1ysR67H3YU"|passwd|bash
echo "concretyourdev\nOe1ysR67H3YU\nOe1ysR67H3YU\n"|passwd
top

MITRE ATT&CK techniques observed:
T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1082 System Information Discovery
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1053 Scheduled Task/Job
T1087 Account Discovery
T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1057 Process Discovery