CAPA
CAPA is a static analysis tool that detects and reports capabilities in executable files across multiple formats, mapping findings to MITRE ATT&CK tactics and techniques.
CAPA is a static analysis tool that detects and reports capabilities in executable files across multiple formats, mapping findings to MITRE ATT&CK tactics and techniques.
Checked October 2026.
CAPA is a static analysis tool designed to detect and identify capabilities within executable files across multiple formats including PE, ELF, .NET, and shellcode.
The tool analyzes binary files to determine what functions and behaviors a program can perform, such as:
CAPA generates detailed reports that map identified capabilities to MITRE ATT&CK tactics and techniques, providing security analysts with structured insights into potential threats. The tool supports both static analysis of executable files and dynamic capability extraction from CAPE sandbox reports.
The analysis results help security professionals understand the behavioral potential of unknown executables without requiring code execution, making it valuable for malware analysis, incident response, and threat assessment workflows.
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about CAPA: features, pricing and alternatives.
CAPA is a product in the Malware Analysis category. It covers PE File, Threat Analysis and ELF.
CAPA is free. Download and setup instructions are at https://github.com/mandiant/capa/.
Alternatives to CAPA listed on CybersecTools:
Compare all CAPA alternatives at https://cybersectools.com/alternatives/capa
CAPA is available as on-premises software. It is listed for small businesses, mid-market companies and enterprises. It is free.
Side by side: features, pricing model and the company behind each one.
Open Source Intelligence solution for threat intelligence data enrichment and quick analysis of suspicious files or malware.
An open source machine code decompiler that converts binary executables into readable C source code across multiple architectures and file formats.
Proprietary sandbox for enterprise malware & payload behavioral analysis.
Malware sandbox for executing malicious files in an isolated environment with advanced features.
A disassembly framework with support for multiple hardware architectures and clean API.
CapTipper is a python tool to analyze, explore, and revive HTTP malicious traffic.
On our shortlist?
No shortlist covers this product's category yet. The closest is Best MDR Solutions for Business.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,030 products.
Connect your AI
