capa (Mandiant)

capa <sample>

Identifies the capabilities of a binary with Mandiant's layer: what the sample does (download, inject, persist) without executing it.

Run it when the sample doesn't match YARA rules and you need to know what it does: capa statically analyzes the binary (control flow, strings, imports) and reports capabilities — 'download files', 'inject a PE into a process', 'persist via Run key' — with the associated ATT&CK technique. It's Mandiant's modern static analysis: the question 'what does this do?' answered in seconds without a sandbox. In IR, capa is the step after a YARA non-match: the new sample is classified by capabilities and the capabilities are mapped to the attack chain.

Don't use it as a verdict: capa identifies capabilities, not intent or attribution — a binary with download capabilities could be a legitimate installer; context (where it came from) decides. Static analysis has limits: obfuscated or packed code reduces what capa sees (capabilities are best detected after unpacking). And note: capa needs the binary on disk — memory-only samples require prior extraction (from the dump). For real behavior, the sandbox complements: capa says what it can do, the sandbox what it did.