fireeye/capa
Capa
capa is a static analysis tool that scans executable files to identify what a program can do, detecting capabilities such as API calls, byte sequences, and structural patterns without executing the code. It supports multiple file formats including PE, ELF, .NET, and shellcode, and can also process runtime behavior traces from sandbox reports generated by CAPE, DRAKVUF, or VMRay.
The tool integrates directly with reverse engineering environments through plugins for IDA Pro and Ghidra, allowing analysts to view capability matches and author detection rules within their disassembler of choice. Capa maps detected behaviors to MITRE ATT&CK tactics and techniques, providing contextual threat analysis, and surfaces results through an interactive web viewer or command-line output.
Detection logic is defined in human-readable YAML rules, which can be extended with custom rules to recognize additional program behaviors. The tool reports the exact addresses and code features that triggered each match, enabling verification of findings during analysis.
Features
- Capability Analyzers - Scans PE, ELF, .NET, and shellcode files to identify what a program can do using static analysis rules.
- Binary and Reverse Engineering - Analyzes PE, ELF, .NET, and shellcode files to extract program capabilities and code features.
- MITRE ATT&CK Analysis - Maps detected program behaviors to MITRE ATT&CK tactics and techniques for contextual threat analysis.
- Disassembler Backend Integrations - Uses IDA, Ghidra, Binary Ninja, CAPE, DRAKVUF, or VMRay as analysis backends to find capabilities within disassembly or dynamic traces.
- Disassembler Integrations - Integrates directly with IDA Pro and Ghidra to surface capability matches within disassembler workflows.
- Binary Feature Extraction - Identifies program capabilities by scanning for predefined byte sequences, API calls, and structural patterns without execution.
- Executable Format Support - Parses and analyzes PE, ELF, .NET, shellcode, and sandbox report formats through a unified extraction pipeline.
- YAML Rule Engines - Extends detection capabilities by allowing custom rules written in a YAML format to recognize additional program behaviors.
- Executable Capability Catalogs - Scans PE, ELF, .NET, shellcode, and sandbox report files to detect and list what a program can do.
- Capability Analyzers - Scans PE, ELF, .NET, and shellcode files to detect what a program can do using static analysis rules.
- Ghidra Feature Extraction Plugins - Extracts program capabilities through Ghidra's analysis engine with results viewable in the Ghidra UI.
- Plugins - Integrates capability detection and rule authoring directly within the IDA Pro disassembler interface.
- Executable Capability Analysis - Scans PE, ELF, .NET, shellcode, or sandbox reports to identify what a program can do, aiding triage and reverse engineering.
- Custom Rule Development - Ships a YAML-based rule engine for authoring custom detection rules to identify program capabilities.
- Binary Analysis Rule Definitions - Matches capabilities against a library of human-readable YAML rules that define detection logic for specific behaviors.
- Binary Code-Level Rule Matching - Detects behaviors by matching rules that describe API calls, constants, and string references at the instruction, block, and function level.
- Capability Match Tracing - Reports the exact addresses and code features that triggered each capability match for verification.
- Ghidra-Based Binary Analysis - Extracts program capabilities by running analysis through Ghidra's feature extraction engine.
- IDA Pro Binary Analysis - Surfaces capability matches and rule authoring features directly within the IDA Pro disassembler using a plugin.
- Sandbox Report Analysis - Processes sandbox-generated reports from CAPE, DRAKVUF, or VMRay to detect capabilities from runtime behavior.
- Sandbox Report Processors - Processes runtime behavior reports from CAPE, DRAKVUF, or VMRay to detect capabilities from execution logs.
- Binary Detection Rule Authoring - Allows writing new detection rules in a YAML-based format to recognize additional program capabilities.
- Ghidra Plugin Integrations - Ships a Ghidra plugin that runs capability detection rules directly within the disassembler's analysis engine.
- IDA Pro Plugin Bridges - Provides an IDA Pro plugin bridge that surfaces capability matches and rule authoring within the disassembler.
- Sandbox Report Parsers - Extracts runtime behavior traces from CAPE, DRAKVUF, and VMRay sandbox reports to detect capabilities.
- Binary Analysis - Detects capabilities in executable files and shellcode.
- Detection and Classification - Detects capabilities and behaviors in executable files.
- Detection and Hunting Tools - Identifies capabilities within executable files.
