Rule finds VBA macro samples that use the ShellExecute "evasion" method specified in the tweet mentioned in the rule.