This rule detects non-allowlisted curl activity on Linux hosts using Auditd Manager or Auditbeat and employs Elastic’s ES|QL COMPLETION with a General Purpose LLM v2 to triage the activity as malicious, benign, or requiring investigation. It ingests Linux process execution events (process.name, process.args, and at least one of process.title or process.args), normalizes the command line, and redacts sensitive values before aggregation. Destination parsing occurs from scheme-based URLs or the last command-line token, with common benign destinations excluded. Events are aggregated per host and destination, collecting up to nine redacted command samples plus contextual fields (parent executable, users, host) to form a single LLM request. The LLM verdict and confidence are parsed; only TP (true positive) or SUSPICIOUS with confidence > 0.7 generate alerts. Mapped ECS fields include host.name, user.name, message, event.reason, event.outcome, event.category, and event.action. The rule maintains a triage context that can be reviewed via Esql.summary and Esql.dest_host. False positives cover routine automation, CI/CD pipelines, health checks, infrastructure tooling, and package downloads to destinations not yet on the allow-list; persistent benign destinations should be added to a deterministic allow-list. Setup notes specify Linux data requirements (Auditd Manager or Auditbeat process events with name, args, and at least one of title or args) and LLM configuration (gp-llm-v2-completion with deterministic destination redaction and pre-checks). The rule maps to MITRE ATT&CK techniques (Ingress Tool Transfer T1105, Exfiltration over Alternative Protocol T1048, Data from Local System T1005) and includes an alert suppression policy by host and destination for 6 hours to reduce noise.