(CommandLine:\/curl* OR CommandLine:\/wget*) (CommandLine:\/tmp\/* OR CommandLine:\/dev\/shm\/*) CommandLine:sh\ \-c*