EMAIL-033: Unsafe attachments are not left in the inbox (GWS.GMAIL.5.5)
- Platform
- Google Workspace
- Category
- Advanced Threat Protection
- Severity
- High
- Zero Trust pillar
- Data (weight 3)
- Golden fixtures
- 6
- Branch coverage
- Declared verdict paths, each proven by a fixture
- Provenance
- baseline
What it checks
SCuBA GWS.GMAIL.5.5: attachment protections only reduce risk if a flagged message is moved out of reach. Detecting a malicious attachment and then leaving it in the inbox means the protection produced a label rather than an outcome, and the user still gets the chance to open it. Reads gmail.email_attachment_safety and requires the anomalous-attachment, encrypted-attachment and script-attachment consequences each to be SPAM_FOLDER or QUARANTINE. A consequence of keeping the mail in the inbox fails.
Recommended value
Every attachment protection moves flagged mail to spam or quarantine
Remediation
Admin console > Apps > Google Workspace > Gmail > Safety > Attachments. For anomalous attachments, encrypted attachments and attachments with scripts, set the action to move the message to spam or to quarantine rather than keeping it in the inbox.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| field-missing | Not Assessed |
| known-bad-anomalous | FAIL |
| known-bad-encrypted | FAIL |
| known-bad-scripts | FAIL |
| not-assessed | Not Assessed |
Framework mappings
- CISA SCuBA
- GWS.GMAIL.5.5v1
- NIST SP 800-53
- SI-3, SI-8, SC-44
- MITRE ATT&CK
- T1566.001