---
name: capa-analysis
description: Use Mandiant's capa tool to automatically identify malware capabilities, map them to ATT&CK and MBC, interpret results, and write custom detection rules.
---

# Capa Analysis

Use Mandiant's capa to automatically identify capabilities in executable files. Capa matches binary behaviors against a library of rules and maps them to MITRE ATT&CK techniques and Malware Behavior Catalog (MBC) objectives.

## Prerequisites

- **capa**: Mandiant's capability detection tool (`pip install flare-capa` or download from GitHub releases)
- **Python 3.10+** for running the runner and rule writer scripts
- **capa rules**: Default rule set (bundled with capa) or custom rules directory

## Steps

### 1. Run Capa Against a Sample

Basic analysis:

```bash
capa sample.exe
```

For structured output, use the runner script which parses JSON and generates organized summaries:

```bash
python3 scripts/capa_runner.py --input sample.exe --output report.json
```

Options:
- `--format summary` (default), `json`, `csv`, or `markdown`
- `--group-by tactic` (default), `mbc`, `namespace`, or `capability`
- `--min-scope function` or `file` or `basic block`
- `--rules /path/to/custom/rules` for custom rule directories
- `--batch /path/to/samples/` to analyze multiple files

### 2. Interpret the Results

Capa output is organized by capability with mappings to:

- **ATT&CK Tactics and Techniques**: What the malware can do in ATT&CK terms
- **MBC Objectives and Behaviors**: Malware-specific behavior categories
- **Namespaces**: capa's own capability hierarchy (e.g., `persistence/registry`, `communication/http`)

Focus on:
- High-impact capabilities (data exfiltration, persistence, defense evasion)
- Unusual combinations that suggest specific malware families
- Capabilities that indicate the malware's stage (dropper, RAT, ransomware)

See `references/capa-guide.md` for detailed output interpretation.

### 3. Write Custom Rules

Generate a rule skeleton from a behavior description:

```bash
python3 scripts/capa_rule_writer.py --name "detect custom packer" \
    --description "Detects the custom UPX-variant packer used by APT-X" \
    --attack T1027.002 \
    --output custom_rules/detect_custom_packer.yml
```

Edit the generated YAML to add specific features (API calls, strings, byte patterns). Use `assets/capa-rule-template.yml` as a reference.

### 4. Test Custom Rules

```bash
capa --rules /path/to/custom_rules/ sample.exe
```

Validate that rules match expected samples and don't produce false positives.

### 5. Batch Analysis

Analyze an entire directory of samples:

```bash
python3 scripts/capa_runner.py --batch /path/to/samples/ --output batch_results/ --format csv
```

This generates per-sample reports and a combined summary.

## References

- `references/capa-guide.md` — Capa usage guide with installation, options, and output interpretation
- `references/capability-categories.md` — Capability categories reference
- `assets/capa-rule-template.yml` — Template capa rule for custom rule development