The DLP agent detects the keyword in the entire email, despite setting a rule for detecting keywords solely within attachments
DLP Release: 15.x, 16.x
DLP Agent performs the detection on the entire message and does not support matching on individual components.
To have DLP perform detection on specific email parts like subject, header, or attachments, consider utilizing Network Prevent for Email