Attachment rules consist of the name of the attachment. Some examples include:

virus
.pif
iloveyou
knownvirus.zip

Note, attachment names are always searched as a "contains" rule, and are they case insensitive.