You will have to use regex as there is no way of matching the ] just for those strings.
If you do this -- UPDATE `table_name` SET 'field_name' = replace(same_field_name, ']', '[/ATTACH]') -- it will update every bb code in the post table with a closing ] to [/ATTACH].
This is a direct port of the original Post Content Find / Replace add-on for XF 1.x. You may wish to search the original resource discussion for solutions to common tasks performed with this add-on.