APT28 NotDoor Outlook VBA Backdoor
Detects APT28's NotDoor VBA backdoor in Microsoft Outlook monitoring emails for trigger words like 'Daily Report'. Uses obfuscated VBA code with Application_MAPILogonComplete and Application_NewMailEx events for persistence and email-based C2.
YARA-L
