Binary capability detection using Mandiant's capa.
| Tool | Description |
|---|---|
capa_analyze |
Analyze binary capabilities |
get_analysis_results |
Retrieve previous analysis |
list_active_scans |
Show running analyses |
- Detect malware capabilities
- MITRE ATT&CK mapping
- Malware Behavior Catalog (MBC) mapping
- PE, ELF, shellcode analysis
- Supports .NET binaries
docker build -t capa-mcp .
docker run --rm -i -v /path/to/samples:/app/samples:ro capa-mcpAnalyze /app/samples/suspicious.exe for malware capabilities
What ATT&CK techniques does this binary use?
MIT