HOW XPROTECT'S DETECTION RULES HAVE CHANGED FROM 2019-2025

Summary from the TLDR InfoSec newsletter

XProtect comprises YARA detection rules employed by Gatekeeper checks to identify known malware. Over six years, the number of rules has quadrupled, and the total size has grown to 22 times its original. This expansion results in longer scan times. However, removing older rules is risky, as it could leave newer Macs vulnerable to malware, especially if they still support x86 execution.