There are a variety of attacks seen from DShield honeypots [1]. Most of the time these commands are human readable. but every now and again they are obfuscated using base64 or hex encoding. A quick look for commands containing the “/x” delimiter give a lot of results encoded in hexadecimal.
Article Link: https://isc.sans.edu/diary/rss/30322