Honeypot attack session (period 2021_2022), commands issued:
/ip cloud print
ifconfig
uname -a
cat /proc/cpuinfo
ps | grep '[Mm]iner'
ps -ef | grep '[Mm]iner'
ls -la /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
echo Hi | cat -n

MITRE ATT&CK techniques observed:
T1016 System Network Configuration Discovery
T1087 Account Discovery
T1083 File and Directory Discovery
T1424 Process Discovery
T1083 File and Directory Discovery
T1059 Command and Scripting Interpreter