capa

capa is a Mandiant FLARE project that inspects PE, ELF, .NET, and shellcode samples and reports capabilities such as installing services or communicating over HTTP. It matches behavior rules against disassembly and maps results to MITRE ATT&CK techniques. Rule sets live in a separate capa-rules repository that is updated by Mandiant and the community. Recent versions can also process dynamic analysis results from sandboxes such as CAPE and DRAKVUF.

First-pass triage of an unknown binary to list its capabilities before committing to manual reverse engineering.

• +A rule library written by reverse engineers describes common malware behaviors.
• +ATT&CK and MBC mapping makes reports useful for detection teams.
• +Integrates with Ghidra, IDA, and sandbox pipelines.

• +Detection depends on rule coverage, so novel behavior goes unreported.
• +Obfuscated or packed samples need unpacking before static analysis works.

Rapid capability assessment of suspected malware to produce ATT&CK mappings for detection engineering.