NotDoor Outlook Macro Detections

[RavenTait]

Details

Four Detections based around the Outlook Macro techniques associated with NotDoor Malware

• Windows Outlook Macro Security Modified
• Windows Outlook Macro Created by Suspicious Process
• Windows Outlook LoadMacroProviderOnBoot Persistence
• Windows Outlook Dialogs Disabled from Unusual Process

One story for NotDoor Malware

Checklist

• Validate name matches <platform>_<mitre att&ck technique>_<short description> nomenclature
• CI/CD jobs passed ✔️
• Validated SPL logic.
• Validated tags, description, and how to implement.
• Verified references match analytic.
• Confirm updates to lookups are handled properly.

[patel-bhavin]