Honeypot attack session (period 2024), commands issued:
linuxshell
sh
enable
shell
echo "cat /proc/1/mounts && ls /proc/1/" | sh 
cat /proc/1/mounts && ls /proc/1/


MITRE ATT&CK techniques observed:
T1059 Command and Scripting Interpreter
T1057 Process Discovery
T1059 Command and Scripting Interpreter
T1222 File and Directory Permissions Modification