reverse-skills-max/vendor-new/analyst-ai-pack/skills/generating-capability-reports-with-capa/SKILL.md

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references

name	description	domain	subdomain	tags	version	author	license	mitre_attack	d3fend	references
generating-capability-reports-with-capa	Uses capa to identify malware capabilities from a binary: running rule-based detection over disassembly, mapping matched capabilities to MITRE ATT&CK and MBC, and interpreting results to focus deeper analysis. Activates for requests to run capa, generate a capability report, or map a sample's behaviors to ATT&CK automatically.	cybersecurity	malware-analysis	malware-analysis capa capability static-analysis mitre-attack mbc	1.0.0	analyst-ai-pack	Apache-2.0	T1059 T1106 T1027	D3-FCR D3-DA	capa (Mandiant FLARE) — https://github.com/mandiant/capa Malware Behavior Catalog (MBC) — https://github.com/MBCProject/mbc-markdown

Generating Capability Reports with capa

When to Use

• You want an automated, rule-based read of what a binary can do before manual reversing.
• You need capabilities mapped to MITRE ATT&CK and the Malware Behavior Catalog (MBC).
• You are prioritizing which functions to reverse based on detected capabilities.

Do not use capa results as a behavioral guarantee — it detects potential capabilities from code patterns; packed samples must be unpacked first or capa sees only the stub.

Prerequisites

• capa installed; the sample handled inertly in the lab.
• For packed samples, an unpacked dump (see the unpacking skills) before running capa.

Safety & Handling

• capa performs static analysis; it does not run the sample. Still handle the sample inertly.
• Keep the sample password-protected at rest and reference it by hash.

Workflow

Step 1: Confirm the sample is analyzable

Verify it is not packed (entropy/imports). If packed, unpack and run capa on the dump, not the stub.

Step 2: Run capa and capture results

Generate the capability report, ideally in JSON for programmatic use plus the human view.

capa -j sample.exe > capa.json
python scripts/analyst.py summarize capa.json

Step 3: Map to ATT&CK and MBC

Group matched rules by ATT&CK technique and MBC behavior to see the sample's capability profile (e.g., persistence, injection, C2, anti-analysis).

Step 4: Prioritize deeper analysis

Use the function addresses capa reports to jump straight to the most interesting code in your disassembler.

Validation

• capa was run on unpacked code, not a packer stub.
• Detected capabilities are corroborated by imports/strings before being trusted.
• The ATT&CK/MBC mapping focuses subsequent manual reversing on real functionality.

Pitfalls

• Running capa on a packed sample and concluding "few capabilities".
• Treating a capa match as confirmed behavior rather than potential capability.
• Ignoring the reported addresses that pinpoint where to reverse.

References

• See references/api-reference.md for the capa summarizer.
• capa and MBC (linked in frontmatter).