You have created a content filtering rule to detect emails with specific attachment size. However, you found that some emails with Microsoft Office 2007 or higher files attached still trigger the policy even the attachment file size does not match the condition.
Symantec Messaging Gateway will always extract compressed files and check the embedded file inside. Since Microsoft Office files are compressed files, there is possibility that the files size of any embedded xml files inside meets the content filtering policy condition.
Symantec is aware of this issue and will update this document when a solution becomes available.
There is no workaround at the moment. Symantec is planning to exclude attachment size checking for files extracted from Microsoft Office files in future build.