BridgeHead proxy auth negotiation - HTTP 407 with Negotiate scheme (retry tracking)
Detects a suspicious proxy authentication negotiation pattern involving multiple HTTP 407 challenges followed by a WebSocket upgrade and the establishment of a SOCKS5 tunnel, indicative of the BridgeHead adversary toolset.
Suricata
