ShimCache Flush via Rundll32
This rule detects attempts to clear the ShimCache (Application Compatibility Cache) on a Windows system. Adversaries may clear this cache to remove forensic evidence of executed programs. The rule specifically looks for `rundll32` executing `apphelp.dll` with `ShimFlushCache` or `#250`, or `rundll32` executing `kernel32.dll` with `BaseFlushAppCompatCache` or `#46`.
YARA-L
