mandiant/capa
Capa
capa is a binary capability scanner that identifies high-level behaviors and actions an executable can perform, such as network communication or file manipulation. It functions as a malware behavior analysis tool and a MITRE ATT&CK mapping framework, scanning PE, ELF, .NET, and shellcode files through both static analysis and dynamic sandbox report processing.
The tool distinguishes itself through a YAML-based detection rule engine that defines detection logic in human-readable files, with conditions expressed as feature combinations and logical operators. It integrates with IDA Pro, Ghidra, and Binary Ninja as a reverse engineering plugin suite, highlighting capability matches and enabling navigation to relevant code. Analysis results can be explored through an interactive web-based viewer with filterable hierarchical trees and evidence details, while the system supports custom rule authoring to extend detection coverage.
capa provides ATT&CK technique mapping to link detected behaviors to standardized threat intelligence context, and processes execution reports from sandboxes to identify capabilities that only appear at runtime. The tool includes installer and packed executable detection to warn when obfuscation may cause misleading results, and offers verbosity filtering to control the depth of rule match output. Analysis result caching saves intermediate data to disk to accelerate repeated scans of the same input file.
Features
- Executable Capability Analysis - Scans PE, ELF, .NET, and shellcode files to identify their functional capabilities for triage and reverse engineering.
- Malware Behavioral Report Generators - Compiles system calls, file operations, and network activity from malware execution into structured reports.
- MITRE ATT&CK Analysis - Uses the MITRE ATT&CK framework to catalog adversary tactics, techniques, and procedures for understanding cyberattacks.
- Rule-to-Taxonomy Mappers - Associates analysis rules with ATT&CK, MAEC, or MBC taxonomy identifiers for standardized capability classification.
- Disassembler Backend Integrations - Loads disassembler-specific plugins that translate native analysis APIs into a common feature extraction interface.
- YAML Rule Engines - Uses YAML-based definitions to match program behaviors against detection logic.
- Hierarchical Rule Evaluators - Implements a hierarchical rule matching engine that evaluates YAML rules in a tree structure for precise capability detection.
- Executable Capability Catalogs - Scans PE, ELF, .NET, and shellcode files to catalog their functional capabilities.
- Disassembler Backend Abstractions - Provides a plugin-based abstraction layer that delegates feature extraction to external disassemblers like IDA Pro and Ghidra.
- Capability Analyzers - Scans binaries to catalog functional capabilities such as code execution, data exfiltration, and anti-analysis techniques.
- Disassembler Plugin Abstractions - Provides a plugin-based abstraction layer that translates native disassembler APIs into a unified feature extraction interface.
- Binary Capability Rule Engines - Scans binary files by matching YAML-defined rules against extracted features to identify high-level capabilities.
- Static-Dynamic Evidence Combiners - Combines static binary features and dynamic sandbox traces into a unified pipeline for comprehensive capability detection.
- Reverse Engineering Integrations - Integrates with IDA Pro, Ghidra, and Binary Ninja to highlight capability matches and navigate to relevant code.
- Disassembler Plugin Suites - Integrates with IDA Pro, Ghidra, and Binary Ninja to highlight capability matches and navigate to relevant code.
- Capability Analysis Report Viewers - Opens an interactive HTML report for exploring detected capabilities and their evidence in a browser.
- Capability Match Tracing - Shows the exact code locations and features that triggered each capability match for verification during analysis.
- Ghidra Feature Extraction Plugins - Provides a Ghidra plugin that extracts program capabilities and displays results in the Ghidra UI.
- IDA Pro Binary Analysis - Integrates with IDA Pro to highlight capability matches and navigate to relevant code.
- Sandbox Report Analysis - Processes execution reports from CAPE, DRAKVUF, and VMRay sandboxes to detect runtime capabilities.
- Binary Detection Rule Authoring - Creates new YAML-based rules that define patterns of API calls, strings, or constants to extend detection coverage.
- Rule Match Tree Viewers - Displays rule matches in an interactive, filterable hierarchical tree view for exploring binary analysis results.
- Interactive Capability Report Browsers - Provides a web-based UI with filterable hierarchical views and evidence details for exploring analysis output.
- Sandbox Report Parsers - Processes API traces from sandboxes to condense thousands of function calls into a behavioral summary.
- Static and Dynamic Analysis Suites - Combines static binary analysis with dynamic sandbox report processing to uncover obfuscated behaviors.
- Analysis Report Viewers - Ships an interactive HTML report viewer with filterable hierarchical trees and evidence navigation for analysis results.
- Binary Analysis Frameworks - Identify capabilities in PE, ELF or .NET executable files.
- Digital Forensics - Tool for identifying capabilities in executable files.
- Malware Analysis Sandboxes - Tool for detecting capabilities in executable files.
