Regex would be the better way to handle it, but after updating to 15.4.6151, we had an issue with Regex where it was matching false positive on emails. For instance, I created a Regex to trap the word Viagra, it appeared to work fine in SM 14.5, but once we upgraded to 15.4.6151 that's when Regex flagged emails randomly when the content it was looking for did not exist in the email.  I already opened a ticket with support on this issue among some other weirdness with spam filtering and content filtering.