APT28 NotDoor Outlook VBA Backdoor (VbaProject.OTM)
Detects the presence of known malicious Outlook VBA project files (VbaProject.OTM), modifications to Outlook macro-security registry keys to enable macro execution, and subsequent network activity initiated by Outlook on devices that have exhibited these suspicious behaviors.
Microsoft Sentinel (KQL)
