Suspicious Outlook Macro File Creation
Detects the creation of a macro file for Outlook, specifically 'VbaProject.OTM', which can be used for persistence or to execute malicious code. The rule filters out legitimate creations by 'outlook.exe' to reduce false positives.
Sigma
