The Ransomware Delivery Vector
Despite advanced firewalls and endpoint antivirus software, the primary delivery vector for enterprise ransomware and targeted espionage remains astonishingly simple: the email attachment. A malicious actor sends an email to the Finance department with a subject line of “Q3 Invoice Discrepancy” and attaches a highly obfuscated PDF, a password-protected ZIP file, or a macro-enabled Microsoft Word document.
Standard spam filters look for known virus signatures. But what if the attacker uses a zero-day exploit? What if they attach an executable file (.exe) but cunningly rename the extension to .txt to bypass basic filters?
To construct an impenetrable, zero-trust barrier against malicious payloads, Google Workspace administrators do not rely on basic spam filtering. They deploy Attachment Compliance Rules. These rules operate deep within the Gmail routing engine, acting as a microscopic inspection facility. They mathematically rip open every single email, interrogate the binary structure of attachments to determine their true file type (ignoring the file extension), and aggressively quarantine or strip dangerous payloads before they ever reach the end-user’s inbox.
Step 1: Accessing the Compliance Engine
Attachment Compliance is a highly advanced routing feature located in the Google Workspace Admin Console.
- Log into the Admin Console (admin.google.com).
- Navigate to Apps > Google Workspace > Gmail > Compliance.
- Scroll down to the Attachment compliance section.
- Click Configure (or Add Another Rule).
You can apply these rules globally (which is highly recommended for security) or restrict them to specific Organizational Units (OUs).
Step 2: Defining the Interception Trigger (Inbound Mail)
The first step is determining which emails to scan. Since we are defending against external attacks, we must intercept inbound traffic.
- Email messages to affect: Check the box for Inbound. (You can also check Internal Receiving to prevent a compromised employee account from spreading a worm laterally across the company).
- Under the Expressions section, click Add.
Step 3: Creating the Rule (The True File Type Trap)
This is where the mathematical power of the compliance engine is revealed.
If you build a rule that says “Block all files ending in .exe“, you have failed. An attacker will simply rename the file invoice.pdf. When the user clicks the PDF on their Windows machine, the malware executes.
Instead, you must instruct Google to ignore the filename entirely and analyze the raw hexadecimal header of the binary file to determine its true nature.
- In the Expression menu, change the dropdown to File type.
- Check the box that says Match based on file contents, not file extension.
- You will be presented with a massive list of document types. You must select every single executable and dangerous script format. Select Executable (EXE), Batch (BAT), PowerShell (PS1), and Visual Basic Script (VBS).
- Click Save.
Now, if an attacker renames a Windows Executable to invoice.txt, the exact millisecond the email hits Google’s servers, the compliance engine scans the binary header, realizes it is an executable disguised as text, and triggers the rule.
Step 4: Creating the Rule (The Encrypted Archive Trap)
The second most common attack vector is the encrypted archive. An attacker sends a password-protected ZIP file and includes the password in the body of the email. They do this because if the ZIP file is encrypted, Google’s antivirus scanners cannot see inside it to detect the malware. If Google can’t scan it, it normally lets it through.
You must block this blind spot.
- Add a second Expression to the rule.
- Change the dropdown to Message properties.
- Select Attachment is encrypted.
- Click Save.
Now, any password-protected ZIP or RAR file sent to your company is mathematically flagged.
Step 5: Executing the Autonomous Action
Once an email triggers either of the conditions (a disguised executable or an encrypted archive), you must tell the engine how to punish the sender.
Scroll down to the Actions section. You have three primary choices:
- Reject message: This bounces the email back to the sender with a custom error (e.g., “550 Policy Rejection: Encrypted archives are forbidden.”). This is highly secure but can frustrate legitimate clients trying to send secure financial data.
- Quarantine message: This intercepts the email and drops it into a hidden, secure vault. The end-user never sees it. An IT Security administrator must manually log into the Quarantine dashboard, review the email safely, and click “Release” if it is legitimate. This is the recommended enterprise posture.
- Modify message (Strip Attachment): This allows the email text to proceed to the user’s inbox, but Google violently rips the attachment out of the email and replaces it with a text file saying “Attachment removed by Corporate Security.” This is excellent because the user still receives the conversation context, but the payload is destroyed.
For maximum security without stopping communication, select Modify message, check Remove attachments, and inject a custom warning message.
Conclusion
Relying on signature-based antivirus scanning is an obsolete defense against modern, obfuscated email threats. By deploying Google Workspace Attachment Compliance Rules, security architects implement a Zero-Trust barrier directly at the mail transport layer. The ability to mathematically interrogate true file types based on binary headers, isolate encrypted payloads, and autonomously strip dangerous attachments ensures that malicious executables are systematically destroyed before they ever reach the vulnerable end-user.