Shimcache Flush via Rundll32

This rule detects attempts to flush Shimcache using rundll32.exe, which can indicate anti-forensic activity or defense evasion by an attacker. The detection logic specifically looks for command-line arguments associated with flushing the Shimcache, including function names like "ShimFlushCache" or "BaseFlushAppcompatCache", and also checks for ordinal values combined with specific DLLs like "apphelp.dll" or "kernel32.dll".