Check new attachment is added/deleted from work item

You can try to create a pre condition/advisor for work item save. See https://rsjazz.wordpress.com/2014/05/26/only-owner-can-close-workitem-advisor/ as an example for such an advisor. It shows the operation ID and the extension point you need. Follow the getting started here and do the extensions workshop mentioned. This is the attachment API: https://rsjazz.wordpress.com/2012/09/21/downloading-attachments-from-work-items/ . The link API used to find the attachments is a common API and is available to server extensions as well.

In the advisor, you will have to get the old state of the work item prior to the save and the new state after the save and compare all the attachment data.