Embedded Images in SMTP Traffic

Hello,

How would I go about implementing an exception to an existing rule I have in place that essentially looks at all email attachments going out containing certain CID (content IDs) associated with certain email attachments. Specifically, I am getting an overwhelming amount of false positives insofar as little email signature blocks (e-cards), social media icons, and email graphics that I have whitelisted as true false positives already?

Would my best option be to use IDM, EDM, or just a simple keyword match?

Note: when I tried to use the keyword match the system said I need to use proximity match pairs (that made me think keyword matching wasn't working).

Thanks.