APT28 NotDoor DLL Sideloading Attack
Detects APT28's NotDoor backdoor deployment using DLL sideloading technique via legitimate signed OneDrive.exe. Loads malicious SSPICLI.dll to disable Outlook macro security and install VBA backdoor targeting NATO organizations.
YARA-L
