https://docs.amazonaws.cn/en_us/guardduty/latest/ug/guardduty-malware-detection-scan-engine.html

" Signature-based detection not only includes matching of bytes but also a snippet of code that is potentially complex, and the scanner can parse content and make decisions."

"With no restriction on the file formats that GuardDuty scans for malware, the scan engines that it uses can detect different types of malware, such as cryptominers, ransomware, and webshells."

Any other bullshit you want to spout there, Genius?