Honeypot attack session (period 2024), commands issued:
enable
system
shell
sh
ping; sh
nan
cat /proc/mounts; /bin/busybox LLBAH
/bin/busybox cat /proc/self/exe || cat /proc/self/exe
cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LLBAH
tftp; wget; /bin/busybox LLBAH
dd bs=52 count=1 if=.s || cat .s || while read i; do echo $i; done < .s
/bin/busybox LLBAH
rm .s; exit
cat /proc/mounts; /bin/busybox HOJZW
cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox HOJZW
tftp; wget; /bin/busybox HOJZW
/bin/busybox HOJZW
cat /proc/mounts; /bin/busybox SYILX
cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox SYILX
tftp; wget; /bin/busybox SYILX
/bin/busybox SYILX
cat /proc/mounts; /bin/busybox CTUYY
cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CTUYY
tftp; wget; /bin/busybox CTUYY
/bin/busybox CTUYY
cat /proc/mounts; /bin/busybox JNCEE
cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox JNCEE
tftp; wget; /bin/busybox JNCEE
/bin/busybox JNCEE
cat /proc/mounts; /bin/busybox FDGRY
cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FDGRY
tftp; wget; /bin/busybox FDGRY
/bin/busybox FDGRY
cat /proc/mounts; /bin/busybox PUEZN
cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox PUEZN
tftp; wget; /bin/busybox PUEZN
/bin/busybox PUEZN
cat /proc/mounts; /bin/busybox YWDQS
cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YWDQS
tftp; wget; /bin/busybox YWDQS
/bin/busybox YWDQS
cat /proc/mounts; /bin/busybox VYEUJ
cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox VYEUJ
tftp; wget; /bin/busybox VYEUJ
/bin/busybox VYEUJ
cat /proc/mounts; /bin/busybox ZYQAG
cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox ZYQAG
tftp; wget; /bin/busybox ZYQAG
/bin/busybox ZYQAG
cat /proc/mounts; /bin/busybox FRVAS
cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox FRVAS
tftp; wget; /bin/busybox FRVAS
/bin/busybox FRVAS
cat /proc/mounts; /bin/busybox XFIPF
cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox XFIPF
tftp; wget; /bin/busybox XFIPF
/bin/busybox XFIPF
cat /proc/mounts; /bin/busybox CUWFB
cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CUWFB
tftp; wget; /bin/busybox CUWFB
/bin/busybox CUWFB
cat /proc/mounts; /bin/busybox QMPBE
cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox QMPBE
tftp; wget; /bin/busybox QMPBE
/bin/busybox QMPBE
cat /proc/mounts; /bin/busybox LTENT
cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox LTENT
tftp; wget; /bin/busybox LTENT
/bin/busybox LTENT
cat /proc/mounts; /bin/busybox YEVPP
cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox YEVPP
tftp; wget; /bin/busybox YEVPP
/bin/busybox YEVPP
cat /proc/mounts; /bin/busybox CPBZK
cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox CPBZK
tftp; wget; /bin/busybox CPBZK
/bin/busybox CPBZK
cat /proc/mounts; /bin/busybox USTIC
cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox USTIC
tftp; wget; /bin/busybox USTIC
/bin/busybox USTIC
cat /proc/mounts; /bin/busybox TXSQK
cd /dev/shm; cat .s || cp /bin/echo .s; /bin/busybox TXSQK
tftp; wget; /bin/busybox TXSQK
/bin/busybox TXSQK

MITRE ATT&CK techniques observed:
T1059 Command and Scripting Interpreter
T1016 System Network Configuration Discovery
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1070 Indicator Removal
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter
T1082 System Information Discovery
T1059 Command and Scripting Interpreter
T1083 File and Directory Discovery
T1036 Masquerading
T1059 Command and Scripting Interpreter
T1105 Ingress Tool Transfer
T1059 Command and Scripting Interpreter