FlexibleFerret Stage 1 - Curl Download

Detects curl command downloading payloads to /var/tmp, indicating potential initial delivery stage of FlexibleFerret malware.

Sigma