Go to Mail flow > Rules.
Create the rule by using one of the following options:



In the New rule dialog box, name the rule, and then select the conditions and actions for this rule:
- In Apply this rule if..., select the condition you want from the list of available conditions:
- In Do the following..., select the action you want the rule to take on messages matching the criteria from the list of available actions:
- Specify how rule match data for this rule is displayed in the Data Loss Prevention (DLP) reports and the Mail protection reports.
- Set the mode for the rule. You can use one of the two test modes to test the rule without impacting mail flow. In both test modes, when the conditions are met, an entry is added to the message trace:
Exchange Online admins can create mail flow rules in the Exchange admin center (EAC) at Mail flow > Rules. You need permissions to do this procedure. After you start to create a new rule, you can see the full list of attachment-related conditions by clicking More options > Any attachment under Apply this rule if. The attachment-related options are shown in the following diagram.

Reference:
https://docs.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules
https://docs.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/inspect-message-attachments