FlexibleFerret Malware File Creation in /var/tmp

Detects creation of suspicious files in /var/tmp consistent with FlexibleFerret malware staging behavior on macOS systems.