SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
generating-capability-reports-with-capa
0
Uses capa to identify malware capabilities from a binary: running rule-based detection over disassembly, mapping matched capabilities to MITRE ATT&CK and MBC, and interpreting results to focus deeper analysis. Activates for requests to run capa, generate a capability report, or map a sample's behaviors to ATT&CK automatically.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Generating Capability Reports with capa ## When to Use - You want an automated, rule-based read of what a binary can do before manual reversing. - You need capabilities mapped to MITRE ATT&CK and the Malware Behavior Catalog (MBC). - You are prioritizing which functions to reverse based on detected capabilities. **Do not use** capa results as a behavioral guarantee — it detects *potential* capabilities from code patterns; packed samples must be unpacked first or capa sees only the stub. ## Prerequisites - `capa` installed; the sample handled inertly in the lab. - For packed samples, an unpacked dump (see the unpacking skills) before running capa. ## Safety & Handling - capa performs static analysis; it does not run the sample. Still handle the sample inertly. - Keep the sample password-protected at rest and reference it by hash. ## Workflow ### Step 1: Confirm the sample is analyzable Verify it is not packed (entropy/imports). If packed, unpack and run capa on the dump, not the stub. ### Step 2: Run capa and capture results Generate the capability report, ideally in JSON for programmatic use plus the human view. ```bash capa -j sample.exe > capa.json python scripts/analyst.py summarize capa.json ``` ### Step 3: Map to ATT&CK and MBC Group matched rules by ATT&CK technique and MBC behavior to see the sample's capability profile (e.g., persistence, injection, C2, anti-analysis). ### Step 4: Prioritize deeper analysis Use the function addresses capa reports to jump straight to the most interesting code in your disassembler. ## Validation - capa was run on unpacked code, not a packer stub. - Detected capabilities are corroborated by imports/strings before being trusted. - The ATT&CK/MBC mapping focuses subsequent manual reversing on real functionality. ## Pitfalls - Running capa on a packed sample and concluding "few capabilities". - Treating a capa match as confirmed behavior rather than potential capability. - Ignoring the reported addresses that pinpoint where to reverse. ## References - See [`references/api-reference.md`](references/api-reference.md) for the capa summarizer. - capa and MBC (linked in frontmatter).