capa
Capability detector that identifies what a binary does and maps findings to MITRE ATT&CK, supporting both static and dynamic analysis.
Technical Architecture & Overview
capa is a Mandiant FLARE project that inspects PE, ELF, .NET, and shellcode samples and reports capabilities such as keystroke logging, C2 communication, or credential dumping. It matches behavior rules against disassembly and maps results to MITRE ATT&CK techniques. Rule sets live in a separate capa-rules repository that is updated by Mandiant and the community. Recent versions can also process dynamic analysis results from sandboxes such as CAPE and DRAKVUF.
Targeted Technical Use Cases
First-pass triage of an unknown binary to list its capabilities before committing to manual reverse engineering.
Evaluation & Trade-offs
Core Strengths
- +Thousands of maintained rules covering common malware behaviors.
- +ATT&CK and MBC mapping makes reports useful for detection teams.
- +Integrates with Ghidra, IDA, and sandbox pipelines.
Trade-Offs & Limitations
- -Detection depends on rule coverage, so novel behavior goes unreported.
- -Obfuscated or packed samples need unpacking before static analysis works.
Defensive Security Application
Rapid capability assessment of suspected malware to produce indicators and ATT&CK mappings for detection engineering.
Frequently Asked Questions
What is capa?→
capa is a Mandiant FLARE project that inspects PE, ELF, .NET, and shellcode samples and reports capabilities such as keystroke logging, C2 communication, or credential dumping. It matches behavior rules against disassembly and maps results to MITRE ATT&CK techniques. Rule sets live in a separate capa-rules repository that is updated by Mandiant and the community. Recent versions can also process dynamic analysis results from sandboxes such as CAPE and DRAKVUF.
What is capa used for?→
First-pass triage of an unknown binary to list its capabilities before committing to manual reverse engineering.
What are the strengths of capa?→
- +Thousands of maintained rules covering common malware behaviors.
- +ATT&CK and MBC mapping makes reports useful for detection teams.
- +Integrates with Ghidra, IDA, and sandbox pipelines.
What are the limitations of capa?→
- +Detection depends on rule coverage, so novel behavior goes unreported.
- +Obfuscated or packed samples need unpacking before static analysis works.
How is capa used defensively?→
Rapid capability assessment of suspected malware to produce indicators and ATT&CK mappings for detection engineering.