reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/generating-capability-reports-with-capa/LICENSE

@@ -0,0 +1,9 @@
+Apache License 2.0 — see the repository root LICENSE file for the full text.
+
+Copyright the AnalystAIPack contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0

vendor-new/analyst-ai-pack/skills/generating-capability-reports-with-capa/SKILL.md

@@ -0,0 +1,93 @@
+---
+name: generating-capability-reports-with-capa
+description: 'Uses capa to identify malware capabilities from a binary: running rule-based
+  detection over disassembly, mapping matched capabilities to MITRE ATT&CK and MBC, and
+  interpreting results to focus deeper analysis. Activates for requests to run capa, generate a
+  capability report, or map a sample''s behaviors to ATT&CK automatically.'
+domain: cybersecurity
+subdomain: malware-analysis
+tags:
+  - malware-analysis
+  - capa
+  - capability
+  - static-analysis
+  - mitre-attack
+  - mbc
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1059
+  - T1106
+  - T1027
+d3fend:
+  - D3-FCR
+  - D3-DA
+references:
+  - 'capa (Mandiant FLARE) — https://github.com/mandiant/capa'
+  - 'Malware Behavior Catalog (MBC) — https://github.com/MBCProject/mbc-markdown'
+---
+
+# Generating Capability Reports with capa
+
+## When to Use
+
+- You want an automated, rule-based read of what a binary can do before manual reversing.
+- You need capabilities mapped to MITRE ATT&CK and the Malware Behavior Catalog (MBC).
+- You are prioritizing which functions to reverse based on detected capabilities.
+
+**Do not use** capa results as a behavioral guarantee — it detects *potential* capabilities from
+code patterns; packed samples must be unpacked first or capa sees only the stub.
+
+## Prerequisites
+
+- `capa` installed; the sample handled inertly in the lab.
+- For packed samples, an unpacked dump (see the unpacking skills) before running capa.
+
+## Safety & Handling
+
+- capa performs static analysis; it does not run the sample. Still handle the sample inertly.
+- Keep the sample password-protected at rest and reference it by hash.
+
+## Workflow
+
+### Step 1: Confirm the sample is analyzable
+
+Verify it is not packed (entropy/imports). If packed, unpack and run capa on the dump, not the
+stub.
+
+### Step 2: Run capa and capture results
+
+Generate the capability report, ideally in JSON for programmatic use plus the human view.
+
+```bash
+capa -j sample.exe > capa.json
+python scripts/analyst.py summarize capa.json
+```
+
+### Step 3: Map to ATT&CK and MBC
+
+Group matched rules by ATT&CK technique and MBC behavior to see the sample's capability profile
+(e.g., persistence, injection, C2, anti-analysis).
+
+### Step 4: Prioritize deeper analysis
+
+Use the function addresses capa reports to jump straight to the most interesting code in your
+disassembler.
+
+## Validation
+
+- capa was run on unpacked code, not a packer stub.
+- Detected capabilities are corroborated by imports/strings before being trusted.
+- The ATT&CK/MBC mapping focuses subsequent manual reversing on real functionality.
+
+## Pitfalls
+
+- Running capa on a packed sample and concluding "few capabilities".
+- Treating a capa match as confirmed behavior rather than potential capability.
+- Ignoring the reported addresses that pinpoint where to reverse.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the capa summarizer.
+- capa and MBC (linked in frontmatter).

vendor-new/analyst-ai-pack/skills/generating-capability-reports-with-capa/references/api-reference.md

@@ -0,0 +1,37 @@
+# API Reference: Generating Capability Reports with capa
+
+## Overview
+
+`scripts/analyst.py` summarizes a capa JSON report, aggregating matched rules by ATT&CK technique,
+MBC behavior, and namespace. It parses an existing report; it does not run capa or the sample.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | JSON, file IO |
+
+## External tools
+
+| Tool | Purpose |
+|------|---------|
+| capa | Rule-based capability detection over disassembly (`capa -j sample.exe`) |
+
+## Core functions
+
+### `summarize(report)`
+Aggregates capa rules into ATT&CK, MBC, and namespace groupings with rule lists/counts.
+
+## Usage
+
+```bash
+capa -j sample.exe > capa.json
+python scripts/analyst.py summarize capa.json
+```
+
+## Sources
+
+- capa (Mandiant FLARE) — https://github.com/mandiant/capa
+- Malware Behavior Catalog (MBC) — https://github.com/MBCProject/mbc-markdown
+- capa detects potential capabilities from code patterns and requires unpacked input, per capa
+  documentation

vendor-new/analyst-ai-pack/skills/generating-capability-reports-with-capa/scripts/analyst.py

@@ -0,0 +1,53 @@
+#!/usr/bin/env python3
+"""Summarize a capa JSON report into an ATT&CK/MBC capability profile.
+
+Reads capa's JSON output and aggregates matched rules by ATT&CK technique and MBC behavior,
+listing rule names and namespaces. It parses an existing report file; it does not run capa or the
+sample itself.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from collections import defaultdict
+from pathlib import Path
+
+
+def summarize(report: dict) -> dict:
+    rules = report.get("rules", {})
+    by_attack = defaultdict(list)
+    by_mbc = defaultdict(list)
+    namespaces = defaultdict(list)
+    for name, rule in rules.items():
+        meta = rule.get("meta", {})
+        for att in meta.get("attack", []) or meta.get("att&ck", []):
+            label = att.get("id") or att.get("technique") if isinstance(att, dict) else str(att)
+            by_attack[str(label)].append(name)
+        for mbc in meta.get("mbc", []):
+            label = mbc.get("id") or mbc.get("behavior") if isinstance(mbc, dict) else str(mbc)
+            by_mbc[str(label)].append(name)
+        ns = meta.get("namespace", "")
+        if ns:
+            namespaces[ns].append(name)
+    return {
+        "rule_count": len(rules),
+        "by_attack": {k: sorted(v) for k, v in sorted(by_attack.items())},
+        "by_mbc": {k: sorted(v) for k, v in sorted(by_mbc.items())},
+        "by_namespace": {k: len(v) for k, v in sorted(namespaces.items())},
+    }
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description="Summarize a capa JSON report")
+    sub = parser.add_subparsers(dest="cmd", required=True)
+    p = sub.add_parser("summarize")
+    p.add_argument("file", help="capa JSON report")
+    args = parser.parse_args(argv)
+    report = json.loads(Path(args.file).read_text(encoding="utf-8"))
+    print(json.dumps(summarize(report), indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())