New Outlook Macro File Creation

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•27

Detects the creation of a macro file for Outlook, specifically 'VbaProject.OTM', which can be used for persistence or to execute malicious code when Outlook is launched.