CAPA is a static analysis tool designed to detect and identify capabilities within executable files across multiple formats including PE, ELF, .NET, and shellcode. The tool analyzes binary files to determine what functions and behaviors a program can perform, such as: - Installing system services - Establishing HTTP communications - Implementing backdoor functionality - Executing various malicious or legitimate operations CAPA generates detailed reports that map identified capabilities to MITRE ATT&CK tactics and techniques, providing security analysts with structured insights into potential threats. The tool supports both static analysis of executable files and dynamic capability extraction from CAPE sandbox reports. The analysis results help security professionals understand the behavioral potential of unknown executables without requiring code execution, making it valuable for malware analysis, incident response, and threat assessment workflows.