The FlashDownloadNotSignedByAdobe analytic will detect the download of any file that contains the word "flash" or "player.dmg" and is not signed by Adobe.
It is very common practice for adware (especially Shlayer) to pose as Adobe Flash Player on different websites in order to get users to install it. This is especially common among websites that display pirated movies. Often times users will believe they need to install Adobe Flash Player in order to watch a movie which leads to the downloading and executing of adware/malware. This is very often delivered in the form of a .dmg file.
For more information about this type of threat see MITRE ATT&CK Tactic: Defense Evasion and MITRE ATT&CK Technique: Masquerading.