Evaluating YARA Rules for macOS Malware Hunting

This report outlines YARA rule best practices for detecting macOS malware, contrasts autogenerated and human-written rules, and demonstrates using Spectra Analyze to retrohunt the Bundlore family (yielding a small number of historical matches); it recommends combining automated and manual rule development and ongoing rule refinement.