mandiant/capa

Health v2 · maintenance only

Adoption not part of the score

6156 stars · 718 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

capa is Mandiant FLARE's open-source tool that identifies capabilities in executable files (PE, ELF, .NET, shellcode) by matching expert-written rules against code-level features. It reports behaviors like persistence, C2 communication, and defense evasion, mapped to MITRE ATT&CK and MBC references.

Use cases

• triage unknown binaries for malicious capabilities
• identify what a suspicious executable can do
• map malware behavior to MITRE ATT&CK techniques
• hunt for novel malware across a file corpus
• guide reverse engineering of an unknown binary
• analyze sandbox reports for capabilities

When to choose

• you need code-level behavioral analysis beyond byte-pattern YARA matching
• you want ATT&CK/MBC-mapped capability reports for triage
• you work in IDA Pro, Binary Ninja, or Ghidra and want integrated results

When to avoid

• you only need static byte-signature scanning like YARA
• you need dynamic runtime behavior monitoring rather than static analysis
• you need full decompilation rather than capability identification

Facets

cli-tool · maturity active

reverse-engineering security cli parser security reverse-engineering developer-tools windows python cli malware-analysis binary-analysis mitre-attack threat-intelligence ida-plugin ghidra linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="mandiant/capa")