{
  "source": ["aws.guardduty"],
  "detail-type": ["GuardDuty Finding"],
  "detail": {
    "type": [{
      "prefix": "Execution:EC2/MaliciousFile"
    }, {
      "prefix": "Execution:EC2/SuspiciousFile"
    }]
  }
}