Honeypot attack session (period 2024), commands issued:
echo 1 && cat /bin/echo
head -c 0 > /tmp/2G9jMdvIEv
chmod 777 /tmp/2G9jMdvIEv
cp /tmp/2G9jMdvIEv /tmp/linux
head -c 0 > /tmp/windows_sign
head -c 0 > /tmp/winminer
head -c 0 > /tmp/mipsel_linux
head -c 0 > /tmp/miner_sign
head -c 0 > /tmp/arm_linux
head -c 0 > /tmp/mips_linux
head -c 0 > /tmp/linux_sign
head -c 0 > /tmp/mipsel_linux_sign
head -c 0 > /tmp/arm_linux_sign
head -c 0 > /tmp/miner
head -c 0 > /tmp/winminer_sign
head -c 0 > /tmp/mips_linux_sign
head -c 0 > /tmp/windows
nan
exit
head -c 0 > /tmp/7P8HBrn7jA
chmod 777 /tmp/7P8HBrn7jA
cp /tmp/7P8HBrn7jA /tmp/linux

MITRE ATT&CK techniques observed:
T1005 Data from Local System
T1070 Indicator Removal
T1222 File and Directory Permissions Modification
T1070 Indicator Removal
T1222 File and Directory Permissions Modification