what rule should I use in suricata so that it detects the curl command on Ubuntu for example for google.com