Detects non-allowlisted curl activity on Linux, macOS, and Windows hosts. The rule uses an LLM to triage whether the curl execution is malicious, benign, or requires investigation. It normalizes the destination, redacts sensitive command line values, and aggregates activity by host and destination before issuing an ES|QL COMPLETION query. Only true positives or suspicious verdicts with confidence above 0.7 generate alerts. The rule relies on process execution events from Elastic Defend, using fields process.name and process.args, and benefits from host, user, and parent process context for better triage. The ES|QL COMPLETION step uses a managed general purpose LLM v2 and can be reconfigured to a different provider with an inference endpoint. Before enabling, review the redaction expressions and the deterministic destination allow-list. The context sent to the LLM includes host and destination counts and up to nine redacted command samples; the model prefixes a one line verdict, confidence and summary. If the model returns a TP or SUSPICIOUS verdict with confidence above 0.7, the rule maps the result to ECS fields: message and event.reason carry the triage summary, event.outcome carries the verdict, category set to intrusion_detection, and action to curl_llm_triage. The alert also includes host.name, user.name, and data_stream.namespace. An alert suppression rule prevents duplicates by grouping on host and destination, suppressing if fields are missing for 6 hours. Threat mappings link the activity to MITRE techniques including Ingress Tool Transfer, Command and Control, Exfiltration, and Data from Local System. False positives include routine automation and benign downloads; persistent benign destinations can be added to a deterministic allow-list.