The drive from where you are seeing this detection, is it shared with other users?
Once we have deleted the file from the location, and again it is coming back that means there is some other process creating it. If not locally then remotely.
If your Artemis Level for OAS is set as Medium, then trigger an ODS (preferably offline) on that Linux box with same Artemis Level.
Once the ODS is complete, check if you are still seeing the detection from OAS.
Curl is shared library here so there is definitely some other application which is using it to trigger these events.