An open-source tool that detects capabilities in executable files like malware, identifying behaviors such as backdoor installation or network communication.
capa is an open-source tool developed by Mandiant's FLARE team that identifies capabilities in executable files, such as malware or suspicious binaries. It analyzes PE, ELF, .NET modules, and shellcode to detect behaviors like backdoor installation, network communication, or data encoding, helping security professionals understand a program's intent. The tool maps these capabilities to the MITRE ATT&CK framework, providing structured insights for threat analysis.
Malware analysts, reverse engineers, and security researchers who need to quickly assess the capabilities of suspicious executables or malware samples. It's also valuable for threat intelligence teams mapping behaviors to known attack patterns.
Developers choose capa for its precise, rule-based detection of malware capabilities, integration with popular disassemblers like IDA Pro and Ghidra, and support for both static and dynamic analysis via sandbox reports. Its open-source nature and extensible rule system allow for community-driven updates and customization.
The FLARE team's open-source tool to identify capabilities in executable files.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports static analysis of PE, ELF, .NET modules, and shellcode, plus dynamic analysis via sandbox reports from CAPE and VMRay, covering a wide range of executable types.
Maps detected capabilities directly to MITRE ATT&CK tactics and techniques, providing standardized, actionable threat intelligence for malware analysts.
Uses an open, YAML-based rule system that allows users to define and share custom signatures, enabling community-driven updates for emerging threats.
Offers plugins for IDA Pro and Ghidra, enabling interactive analysis and feature extraction within popular reverse engineering environments.
Static analysis often fails against obfuscated or packed executables, as highlighted in the README warnings, requiring dynamic sandbox reports for accurate detection.
Detection accuracy hinges on rule quality; writing effective rules demands malware analysis expertise, and gaps in the rule set can lead to false negatives.
Designed for offline analysis of files or logs, not for monitoring running processes or network traffic, limiting use in active defense scenarios.