Goose CLI Git core.fsmonitor Command Execution Chain

How the attack works

An attacker prepares a git repository with the `core.fsmonitor` setting pointing to a shell command instead of a real filesystem-watcher. A victim runs `goose review` on the repository, which internally invokes git. Git reads the poisoned `core.fsmonitor` value and executes it through a shell as a child process. The detection watches for this specific chain: goose spawning git, which spawns a shell or interpreter, combined with signs that the command line references fsmonitor and shows suspicious behavior like remote fetches, encoded payloads, or reverse-shell patterns.

Netzilo detection

Why it matters

An attacker who gets a victim to open or review a repository with Goose can achieve arbitrary command execution on the victim's machine, potentially leading to full compromise of that host.

What you can do

• →Treat untrusted git repositories as executable content - review `.git/config` and any repo-supplied config before running AI tools or git commands against them.
• →Avoid running `goose review` or similar automated git-invoking tools against repositories from unknown or untrusted sources.
• →Restrict or audit use of `core.fsmonitor` and similar git hook/config mechanisms in shared or CI environments.
• →Monitor for git spawning shells or interpreters with network-fetch, eval, or decode behavior, and investigate rather than assume it's a legitimate fsmonitor helper.

Known benign look-alikes

• Developers who legitimately use a filesystem-monitor hook (watchman, rs-git-fsmonitor) inside a goose session - the config string contains "fsmonitor" and git spawns the helper through a shell, satisfying indicators (1) and (2). This is the dominant benign case and the reason the rule only reports.
• Git hooks (pre-commit, post-checkout, husky) that fetch dependencies with curl/wget while goose is driving git - satisfies indicators (2) and (3).
• Security researchers or the owning team intentionally reproducing this advisory.
• Unrelated binaries named "goose" (for example the goose database-migration tool) running git plus shell steps during a migration.
• Repository-local git aliases that pipe a remote script into a shell as part of a sanctioned build workflow.

References

• https://attack.mitre.org/techniques/T1059/004/
• https://attack.mitre.org/techniques/T1546/
• https://git-scm.com/docs/git-config#Documentation/git-config.txt-corefsmonitor