Back to Checks
googleworkspace

Protection against attachments with scripts from untrusted senders is enabled

gmail_script_attachment_protection_enabled
Service: gmailSeverity: medium
OfficialBuilt-inVerified
Categories:email-security
Resource Type:NotDefined

Verifies that Gmail is configured to take a protective action (such as moving to spam, quarantining, or showing a warning) when an attachment containing scripts is received from an untrusted sender. Script-bearing attachments (e.g., .js, .vbs, .ps1) are a common malware delivery mechanism.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

Without protection against script-bearing attachments from untrusted senders, users may receive files containing malicious scripts that can execute harmful code when opened. Attackers commonly use script attachments to deliver malware, backdoors, or credential stealers.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks gmail_script_attachment_protection_enabled

Recommendation

Enable protection against attachments with scripts from untrusted senders and configure an appropriate action such as moving to spam or quarantining.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Gmail**
3Click **Safety** > **Attachments**
4Check **Protect against attachments with scripts from untrusted senders**
5Select the desired action (e.g., Move email to spam)
6Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.gmail.gmail_client import gmail_client


class gmail_script_attachment_protection_enabled(Check):
    """Check that protection against attachments with scripts from untrusted senders is enabled.

    This check verifies that Gmail is configured to take action on
    attachments containing scripts from untrusted senders, helping
    prevent malware delivery via script-bearing files.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if gmail_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=gmail_client.policies,
                resource_id="gmailPolicies",
                resource_name="Gmail Policies",
                customer_id=gmail_client.provider.identity.customer_id,
            )

            enabled = gmail_client.policies.enable_script_attachment_protection
            consequence = gmail_client.policies.script_attachment_protection_consequence

            if enabled is False:
                report.status = "FAIL"
                report.status_extended = (
                    f"Protection against attachments with scripts from "
                    f"untrusted senders is disabled in domain "
                    f"{gmail_client.provider.identity.domain}. "
                    f"Enable the protection and configure a protective action."
                )
            elif consequence == "NO_ACTION":
                report.status = "FAIL"
                report.status_extended = (
                    f"Protection against attachments with scripts from "
                    f"untrusted senders is set to take no action in domain "
                    f"{gmail_client.provider.identity.domain}. "
                    f"A protective action should be configured."
                )
            elif consequence is None:
                report.status = "PASS"
                report.status_extended = (
                    f"Protection against attachments with scripts from "
                    f"untrusted senders uses Google's secure default "
                    f"configuration (enabled) in domain "
                    f"{gmail_client.provider.identity.domain}."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Protection against attachments with scripts from "
                    f"untrusted senders is enabled with consequence "
                    f"'{consequence}' in domain "
                    f"{gmail_client.provider.identity.domain}."
                )

            findings.append(report)

        return findings

References