If you don't expect your users to receive shell script email attachments from untrusted sources (which could be the initial attack vector here), then blocking the SH extension would be one simple step. Of course, there are a few more things you could do: blocking shell script shebang signatures, zipped files with the executable bit set etc.

If this is something you want from your email provider, along with some other simple defenses [1][2], then please drop me an email at [email protected], I work on an email startup in private beta.

[1] https://blog.cotten.io/ghost-emails-hacking-gmails-ux-to-hid...

[2] https://snyk.io/blog/how-to-crash-an-email-server-with-a-sin...