Back to Checks
googleworkspace

Protection against anomalous attachment types in emails is enabled

gmail_anomalous_attachment_protection_enabled
Service: gmailSeverity: medium
OfficialBuilt-inVerified
Categories:email-security
Resource Type:NotDefined

Verifies that Gmail is configured to take a protective action (such as moving to spam, quarantining, or showing a warning) when emails contain anomalous attachment types. Unusual file types that are uncommon for the sender or organization may indicate an attempt to deliver malware through less-scrutinized formats.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

Without protection against anomalous attachment types, users may receive emails with unusual file formats that are designed to bypass standard security filters. Attackers may use uncommon file extensions or MIME types to deliver malware that evades signature-based detection.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks gmail_anomalous_attachment_protection_enabled

Recommendation

Enable protection against anomalous attachment types in emails and configure an appropriate action such as moving to spam or quarantining.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Gmail**
3Click **Safety** > **Attachments**
4Check **Protect against anomalous attachment types in emails**
5Select the desired action (e.g., Move email to spam)
6Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.gmail.gmail_client import gmail_client


class gmail_anomalous_attachment_protection_enabled(Check):
    """Check that protection against anomalous attachment types in emails is enabled.

    This check verifies that Gmail is configured to take action on
    emails containing unusual attachment types, helping prevent
    malware delivery via uncommon file formats.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if gmail_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=gmail_client.policies,
                resource_id="gmailPolicies",
                resource_name="Gmail Policies",
                customer_id=gmail_client.provider.identity.customer_id,
            )

            enabled = gmail_client.policies.enable_anomalous_attachment_protection
            consequence = (
                gmail_client.policies.anomalous_attachment_protection_consequence
            )

            if enabled is False:
                report.status = "FAIL"
                report.status_extended = (
                    f"Protection against anomalous attachment types in emails "
                    f"is disabled in domain "
                    f"{gmail_client.provider.identity.domain}. "
                    f"Enable the protection and configure a protective action."
                )
            elif enabled is None:
                report.status = "FAIL"
                report.status_extended = (
                    f"Protection against anomalous attachment types in emails "
                    f"is not configured and uses Google's insecure default "
                    f"(disabled) in domain "
                    f"{gmail_client.provider.identity.domain}. "
                    f"Enable the protection and configure a protective action."
                )
            elif consequence == "NO_ACTION":
                report.status = "FAIL"
                report.status_extended = (
                    f"Protection against anomalous attachment types in emails "
                    f"is set to take no action in domain "
                    f"{gmail_client.provider.identity.domain}. "
                    f"A protective action should be configured."
                )
            elif consequence is None:
                report.status = "PASS"
                report.status_extended = (
                    f"Protection against anomalous attachment types in emails "
                    f"is enabled in domain "
                    f"{gmail_client.provider.identity.domain}."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Protection against anomalous attachment types in emails "
                    f"is enabled with consequence '{consequence}' "
                    f"in domain {gmail_client.provider.identity.domain}."
                )

            findings.append(report)

        return findings

References