Capa
An open-source tool that detects capabilities in executable files like malware, identifying behaviors such as backdoor installation or network communication.
What is Capa?
capa is an open-source tool developed by Mandiant's FLARE team that identifies capabilities in executable files, such as malware or suspicious binaries. It analyzes PE, ELF, .NET modules, and shellcode to detect behaviors like backdoor installation, network communication, or data encoding, helping security professionals understand a program's intent. The tool maps these capabilities to the MITRE ATT&CK framework, providing structured insights for threat analysis.
Malware analysts, reverse engineers, and security researchers who need to quickly assess the capabilities of suspicious executables or malware samples. It's also valuable for threat intelligence teams mapping behaviors to known attack patterns.
Developers choose capa for its precise, rule-based detection of malware capabilities, integration with popular disassemblers like IDA Pro and Ghidra, and support for both static and dynamic analysis via sandbox reports. Its open-source nature and extensible rule system allow for community-driven updates and customization.
Overview
The FLARE team's open-source tool to identify capabilities in executable files.
Use Cases
Best For
- Identifying malware capabilities in PE, ELF, or .NET executables
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
