# CAPA

CAPA is a Malware Analysis product. It runs on-premises. Pricing is free.

CAPA is a static analysis tool that detects and reports capabilities in executable files across multiple formats, mapping findings to MITRE ATT&CK tactics and techniques.

Checked October 2026.

## What is CAPA?

CAPA is a static analysis tool designed to detect and identify capabilities within executable files across multiple formats including PE, ELF, .NET, and shellcode.

The tool analyzes binary files to determine what functions and behaviors a program can perform, such as:
- Installing system services
- Establishing HTTP communications
- Implementing backdoor functionality
- Executing various malicious or legitimate operations

CAPA generates detailed reports that map identified capabilities to MITRE ATT&CK tactics and techniques, providing security analysts with structured insights into potential threats. The tool supports both static analysis of executable files and dynamic capability extraction from CAPE sandbox reports.

The analysis results help security professionals understand the behavioral potential of unknown executables without requiring code execution, making it valuable for malware analysis, incident response, and threat assessment workflows.

Tags: PE File, Threat Analysis, ELF, Shellcode, Binary Analysis, Executable Analysis

## Where it fits in your security program (NIST CSF 2.0)

- [Detect](https://cybersectools.com/guides/building-detect-program-small-team): helps you spot attacks and unusual activity.
- [Respond](https://cybersectools.com/guides/building-respond-program-small-team): helps you contain and handle incidents.

## Quick facts

- Category: [Security Operations](https://cybersectools.com/categories/security-operations) · [Malware Analysis](https://cybersectools.com/categories/malware-analysis)
- Deployment: On-Premises
- Company size fit: SMB, Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 5,887
- Website: github.com

## Where it ranks

No shortlist covers this product's category yet. The closest is [Best MDR Solutions for Business](https://cybersectools.com/shortlists/best-mdr-solutions).

## CAPA FAQ

### What is CAPA?

CAPA is a product in the Malware Analysis category. It covers PE File, Threat Analysis and ELF.

### What is the pricing for CAPA?

CAPA is free. Download and setup instructions are at https://github.com/mandiant/capa/.

### What are alternatives to CAPA?

Alternatives to CAPA listed on CybersecTools:

1. [Joe Sandbox DEC](https://cybersectools.com/tools/joe-sandbox-dec) - Plugin that decompiles malware PE files into readable C code using hybrid analysis. (Commercial)
2. [Zenyard RE Agent](https://cybersectools.com/tools/zenyard-re-agent) - AI agent for in-depth binary analysis and reverse engineering assistance. (Commercial)
3. [RevEng.AI](https://cybersectools.com/tools/revengai) - AI-powered binary analysis platform for reverse engineering & malware analysis. (Commercial)
4. [Splunk Attack Analyzer](https://cybersectools.com/tools/splunk-attack-analyzer) - Automated threat analysis platform for phishing and malware investigation (Commercial)
5. [ReversingLabs Spectra Analyze](https://cybersectools.com/tools/reversinglabs-spectra-analyze) - Malware analysis platform for SOC teams with binary analysis and threat detection (Commercial)

Compare all CAPA alternatives at [https://cybersectools.com/alternatives/capa](https://cybersectools.com/alternatives/capa)

### What deployment and organization size does CAPA fit?

CAPA is available as on-premises software. It is listed for small businesses, mid-market companies and enterprises. It is free.

## Compare CAPA with similar solutions

- [CAPA vs Joe Sandbox DEC](https://cybersectools.com/compare/capa-vs-joe-sandbox-dec)
- [CAPA vs Zenyard RE Agent](https://cybersectools.com/compare/capa-vs-zenyard-re-agent)
- [CAPA vs RevEng.AI](https://cybersectools.com/compare/capa-vs-revengai)

All alternatives to CAPA: [/alternatives/capa](https://cybersectools.com/alternatives/capa)

---

Source: https://cybersectools.com/tools/capa

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on CAPA: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md