CAPA
CAPA is a static analysis tool that detects and reports capabilities in executable files across multiple formats, mapping findings to MITRE ATT&CK tactics and techniques.
CAPA
CAPA is a static analysis tool that detects and reports capabilities in executable files across multiple formats, mapping findings to MITRE ATT&CK tactics and techniques.
CAPA Description
CAPA is a static analysis tool designed to detect and identify capabilities within executable files across multiple formats including PE, ELF, .NET, and shellcode. The tool analyzes binary files to determine what functions and behaviors a program can perform, such as: - Installing system services - Establishing HTTP communications - Implementing backdoor functionality - Executing various malicious or legitimate operations CAPA generates detailed reports that map identified capabilities to MITRE ATT&CK tactics and techniques, providing security analysts with structured insights into potential threats. The tool supports both static analysis of executable files and dynamic capability extraction from CAPE sandbox reports. The analysis results help security professionals understand the behavioral potential of unknown executables without requiring code execution, making it valuable for malware analysis, incident response, and threat assessment workflows.
CAPA FAQ
Common questions about CAPA including features, pricing, alternatives, and user reviews.
CAPA is CAPA is a static analysis tool that detects and reports capabilities in executable files across multiple formats, mapping findings to MITRE ATT&CK tactics and techniques. It is a Security Operations solution designed to help security teams with Pe File, Threat Analysis, Elf.
