Add Git configuration command execution rules

[signalblur]

Summary of the Pull Request

Two process_creation rule families for Git configuration that names a program Git then runs. No existing rule references any of these keys or options.

Shell Command in Git Configuration Value (high) matches a configuration key set on the command line to a value that invokes a shell or an interpreter. Git executes the values of core.pager, core.fsmonitor, core.editor, core.sshCommand, core.alternateRefsCommand, diff.external, sequence.editor, pager.<cmd> and filter.<name>.clean during ordinary operations, and treats a credential.helper or alias.<name> value beginning with ! as a shell snippet.

Git Pack or Proxy Program Override (medium) matches --upload-pack, --receive-pack, the remote.<name>.uploadpack and remote.<name>.receivepack configuration equivalents, uploadpack.packObjectsHook and core.gitProxy. Against a local path these run on the host issuing the command.

Every primitive listed was confirmed executing on git 2.52.0 before it was included, with the single exception noted at the end. Matching command lines:

git -c credential.helper='!sh -c id' ls-remote https://x/y
git -c core.pager='sh -c id' log -1
git -c core.fsmonitor='sh -c id' status
git clone --upload-pack='touch /tmp/pwn' /src /dst
git -c core.gitProxy=/tmp/p.sh ls-remote git://h.invalid/x

Not matched: git -c core.pager=cat log, git -c core.editor=vim commit, git -c core.fsmonitor=true status, git config credential.helper osxkeychain, git -c filter.lfs.clean='git-lfs clean -- %f' add ., and git config --global alias.lg '!git log --graph' — the common shell alias, which carries no = before the !.

The Windows rule adds the quoted spellings, because Windows records the command line as one string and keeps the quoting the other two platforms strip. It also keeps the Unix interpreter forms, since Git for Windows ships a POSIX shell.

uploadpack.packObjectsHook is the one keyword included on documentation rather than on a local observation. git-config(1) states that when upload-pack would run git pack-objects, "it will run this shell command instead", and that the key "is only respected when it is specified in protected configuration" — the scope that covers the -c form this rule matches. It is a server-side key, and I could not drive it from a client-side test here, so I am flagging it rather than implying it was measured like the rest.

Changelog

new: Shell Command in Git Configuration Value - Linux
new: Shell Command in Git Configuration Value - MacOS
new: Shell Command in Git Configuration Value - Windows
new: Git Pack or Proxy Program Override - Linux
new: Git Pack or Proxy Program Override - MacOS
new: Git Pack or Proxy Program Override - Windows

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions