Watchdog Liveness Curl Check Against Tunnel via Loop or LaunchAgent
Detects curl liveness/health-check requests against a known tunnel domain issued repeatedly from a loop construct or a LaunchAgent/watchdog parent, indicating an automated watchdog keeping a reverse tunnel alive.
Sigma
