README

Website
  |
  Download
  |
  Web Interface













---

capa detects capabilities in executable files.
You run it against a PE, ELF, .NET module, shellcode file, or a sandbox report and it tells you what it thinks the program can do.
For example, it might suggest that the file is a backdoor, is capable of installing services, or relies on HTTP to communicate.

To interactively inspect capa results in your browser use the capa Explorer Web.

If you want to inspect or write capa rules, head on over to the capa-rules repository. Otherwise, keep reading.

Below you find a list of our capa blog posts with more details.

 example capa output

$ capa.exe suspicious.exe

+--------------------+------------------------------------------------------------------------+
| ATT&CK Tactic      | ATT&CK Technique                                                       |
|--------------------+------------------------------------------------------------------------|
| DEFENSE EVASION    | Obfuscated Files or Information [T1027]                                |
| DISCOVERY          | Query Registry [T1012]                                                 |
|                    | System Information Discovery [T1082]                                   |
| EXECUTION          | Command and Scripting Interpreter::Windows Command Shell [T1059.003]   |
|                    | Shared Modules [T1129]                                                 |
| EXFILTRATION       | Exfiltration Over C2 Channel [T1041]                                   |
| PERSISTENCE        | Create or Modify System Process::Windows Service [T1543.003]           |
+--------------------+------------------------------------------------------------------------+

+-------------------------------------------+-------------------------------------------------+
| CAPABILITY                                | NAMESPACE                                       |
|-------------------------------------------+-------------------------------------------------|
| read and send data from client to server  | c2/file-transfer                               |
| execute shell command and capture output  | c2/shell                                       |
| receive data (2 matches)                  | communication                                   |
| send data (6 matches)                     | communication                                   |
| connect to HTTP server (3 matches)        | communication/http/client                       |
| send HTTP request (3 matches)             | communication/http/client                       |
| create pipe                               | communication/named-pipe/create                 |
| get socket status (2 matches)             | communication/socket                            |
| receive data on socket (2 matches)        | communication/socket/receive                    |
| send data on socket (3 matches)           | communication/socket/send                       |
| connect TCP socket