Google Message Security for Google Apps Administration Guide - Manual (Page 239)

Content Manager 239
A content filter captured messages that don’t contain any words, phrases, or
patterns I specified in the filter rules. Why?
If the message contains a file attachment, the value you specified in the filter rule
might appear in the attachment. If you selected Body for the filter’s rule location,
Content Manager still scans any plain-text attachments, including attached email
messages. If you selected the location Entire Message, Content Manager also
scans binary attachments, such Microsoft Office files.
If you can’t find the value in the attachment, check the source code of the email
message itself. If the message includes a binary attachment (such as a Microsoft
Office file), Content Manager scans the MIME encoded sections of the message
for those attachments. These sections appear as long, random strings of
characters without spaces in the message source. To prevent Content Manager
from matching words in the MIME encoded sections, use a regular expression to
match entire (whole) words only. For details, see “Match Whole Word Only” on
page 226.
I created a content filter to find specific words, but messages with those words
in file attachments are getting through. Why?
If a message contains a binary attachment, such as a Microsoft Office file,
Content Manager does not scan the text content of that attachment unless you
select Entire Message for the rule location.