A file with the following text would activate the rule: <?php ='base'.(16*4).'_de'.'code' (str_replace( .substr(md5(strrev( gzinflate

A file with the following text would activate the rule: <?php ='base'.(16*4).'_de'.'code' (str_replace( .substr(md5(strrev( gzinflate _COOKIE _COOKIE isset isset isset (additional text, such that the total filesize is between 20kb and 22kb) Basically, in the filesize must be between 20bk and 22kb, all of the defined strings must be found, and the cookie and isset strings must occur exactly 2 and 3 times respectively.