WAF rules: Evaluation Penalty box conditions