capa reveals malware capabilities without running it

you found a weird exe. now what.

somebody emailed you an attachment, or you pulled a binary off a machine that's acting funny, or your edr flagged something and dumped a file on your desktop. the old move was firing up a debugger, or worse, just running it in a vm and hoping you're watching closely enough. both of those take time you might not have, especially if you're triaging ten of these a week instead of one.

capa skips all of that. it's a static analysis tool from mandiant that reads a binary's code, without executing a single instruction, and tells you in plain english what that binary is capable of doing. no detonation, no sandbox, no waiting to see what it phones home to.

the command

capa suspicious.exe

that's it. point it at a file and it goes to work. under the hood capa is scanning the binary's disassembly, strings, imports, and control flow against a huge library of rules that describe known malicious and benign behaviors. things like "creates a registry run key," "resolves imports by hash," "checks for a debugger," "encrypts data using rc4." each rule is written by researchers who've seen that pattern in real malware, so you're not guessing, you're matching against documented behavior.

what the output actually tells you

run it and you get a table. one column is the capability in human language, the other maps it straight to a mitre att&ck technique id. so instead of staring at disassembly trying to figure out why a function keeps calling InternetOpenA, capa just says "command and control over http" and hands you the technique number to go with it.

a typical result on something nasty might show: persistence via a run key, sandbox and vm detection checks, data encryption, http based c2 traffic, and process injection. all of that surfaces in seconds, without capa ever letting the code touch memory in a way that could actually cause harm.

why static beats dynamic when you're in a hurry

dynamic analysis, meaning actually running the sample in a sandbox, is great for catching behavior that only shows up at runtime. but it's slow, it requires a properly isolated environment, and plenty of modern malware checks for sandboxes and just refuses to act malicious if it thinks it's being watched. capa doesn't care about any of that because it never runs the file. it reads the code as written, so evasive tricks meant to fool a sandbox don't help the malware hide from capa.

that doesn't mean capa replaces sandboxing or full reverse engineering. it means it gives you a fast first pass so you know what you're dealing with before you decide how much deeper to go.

how you actually use this to defend your stuff

if you're a defender or sysadmin, here's where this earns its keep:

triage inbound files fast. attachments, downloads, anything a user flags as "this looks off." run capa before you decide whether it's worth a full investigation or a quick delete and move on.

build detections from what you find. if capa tells you a binary persists via a run key and talks to a c2 over http, go check your own endpoints for that exact run key path and monitor outbound http to unusual destinations. you're turning a single file's behavior profile into detection rules for your whole environment.

validate your edr and av. run capa against samples your security tools already caught, and confirm the capabilities line up with what your alerts say. mismatches are worth digging into.

document incidents properly. having a clean list of att&ck techniques for every sample you handle makes writing up an incident report way less painful, and it gives you a consistent way to compare malware you see over time.

the takeaway

capa isn't about attacking anything, it's about not wasting your afternoon manually reversing a file just to find out it drops a shortcut in startup and calls home over port 80. install it, point it at files you're already responsible for analyzing, cross reference the att&ck ids against your own logging and detections, and you'll close the gap between "found a suspicious file" and "know exactly what to hunt for" a lot faster than you did yesterday.