Suspicious Download and Execute Pattern through Curl/Wget (via process_creation)

This rule detects anomalous use of command-line tools such as curl or wget to download remote content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by immediate execution, suggesting potential hostile activity. This pattern is frequently used by hostile scripts, stagers, or downloaders in fileless or multi-stage Linux attacks.