Honeypot attack session (period 2024), commands issued:
start
enable
config terminal
system
linuxshell
shell
sh
echo -e '\x6D\x62\x6A\x72\x79'
passwd
cd /tmp || cd /var || cd /dev || cd /etc
cat /bin/ls|more
cat /bin/ls|head -n 1

MITRE ATT&CK techniques observed:
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1083 File and Directory Discovery
T1005 Data from Local System