Three parts to it:
1. Attachments...
Only check the extension portion And if it contains this... gif Then do this: Action: Logical AND
2. Expression...
If this regular expression *multipart/related* Occurs in the message's Headers only Then do this: Action: Logical AND
3. Scan list ...
If the sender is a member of this distribution list @white.pml Then do this: Action: Move to Junk Trigger if the sender is NOT a list member
I've adapted this rule from here:
http://www.hawkwings.net/2006/12/20/another-mailapp-rule-to-catch-image-spam/
It's based on the observation that image spam is sent as multipart/related and generally uses the GIF format. By adding your address book to the whitelist you can also cover the possibility that someone you know might do this even if it's unlikely.
Obviously one could replace "gif" in the first rule with "gif,jpg" and check "This string is a list of possible values, separated by commas", but false positives would then be more likely. Unfortunately, some spammers do now seem to be using JPEGs, perhaps having caught on to the fact that people are filtering messages with embedded gifs straight to junk folders or the trash.
It's an odd twist of fate that remote graphics used to be the problem. Now most mail clients block those by default and only download them on request, so that they've ceased to be so much a problem. By contrast, it seems an embedded graphic is now more likely a sign of a nefarious message.