System auditing is used to track updates to fields on a table when the audit attribute has been enabled. By default, the system tracks changes to the Task table and it's child tables (Incident, Change Request, Problem, etc.). However, it is important to note that adding or removing attachments will note be tracked on the Task table, even if you enable audit for the sys_attachment table. This is because the sys_attachment table is a completely independent table to the Task table where you are expecting to see the updates.
In cases where similar functionality is required, this can be done via customization.
An example customization: