Honeypot attack session (period 2021_2022), commands issued:
mkdir .ssh

MITRE ATT&CK techniques observed:
T1098 Account Manipulation