Which AWS service or feature will meet these requirements?

Explanations:

Amazon GuardDuty can detect threats like malware by analyzing AWS CloudTrail, VPC Flow Logs, and DNS logs.

Network ACLs control inbound and outbound traffic at the subnet level but do not provide malware detection.

AWS WAF protects against web application threats, but it does not specifically detect or prevent malware.

AWS Network Firewall offers advanced network protections but is not designed to detect malware in itself.