CAPA Cheatsheet
What It Is
Mandiant's tool that automatically identifies capabilities in PE files using a rule-based engine.
Usage
capa suspicious.exe # Default analysis
capa -v suspicious.exe # Verbose (show rule matches)
capa -vv suspicious.exe # Very verbose (show evidence)
capa -j suspicious.exe # JSON output
Output Categories
- Capability: What the malware can do
- ATT&CK: Mapped MITRE ATT&CK techniques
- MBC: Mapped Malware Behavior Catalog entries
- Namespace: Category grouping
Example Output Interpretation
+---------------------------+---+
| ATT&CK Tactic | # |
+---------------------------+---+
| PERSISTENCE | 2 |
| DEFENSE EVASION | 3 |
| DISCOVERY | 1 |
| COMMAND AND CONTROL | 2 |
+---------------------------+---+
Pro Tip
Run CAPA early in your analysis workflow – it gives you a high-level capability overview before you dive into manual analysis.