alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET USER_AGENTS FastHTTP User-Agent Observed Outbound (fasthttp)"; flow:established,to_server; http.user_agent; bsize:8; content:"fasthttp"; fast_pattern; threshold:type limit, count 1, seconds 300, track by_src; reference:url,github.com/valyala/fasthttp; classtype:misc-activity; sid:2059373; rev:1; metadata:attack_target Client_Endpoint, tls_state plaintext, created_at 2025_01_21, deployment Perimeter, confidence High, signature_severity Informational, updated_at 2025_01_21; target:src_ip;)