Any spectrum analyzer with a tracking generator (TG) could be used to find one. Sweep the spectrum with the TG off, save the waveform as a reference. Then turn

Any spectrum analyzer with a tracking generator (TG) could be used to find one. Sweep the spectrum with the TG off, save the waveform as a reference. Then turn the TG on, measure the return strength, watch for where it jumps above the reference. I've got a device capable of this as a hobbyist (Siglent SSA3021X-TG). Such bugs are undetectable by cheap equipment, but we've known about them for decades and any competent counterintelligence team will be able to spend the extra 2-3 thousand dollars for a good detector. It's chump change.