This can be done, but comes with a bit of tricky configuration (has to be deployed with some discretion)
AMP's primary responsibility is to scan attachments and detect possible malware inside them. Now most customers choose to set the action as drop when the attachment is flagged as "malware". Since this is a "final action", the email doesn't go through any additional scanning.
You can choose to change this option to "deliver as is" , configure the AMP policy to add a custom header.
Then use that header as a condition in a content filter, configure 2 actions.
1st action - Notify "sender", (use notification templates if needed)
2nd action - Drop, so that the email isn't delivered to recipient.
