APT28 NotDoor VbaProject.OTM Created by Non-Outlook Process
Detects the creation or modification of the VbaProject.OTM file, which stores VBA macros for Microsoft Outlook, by a process other than the Outlook application (OUTLOOK.EXE). This is a common technique used to deploy malicious macros for persistence or code execution within the Outlook environment.
Microsoft Sentinel (KQL)
