Skip to content

CAPA

Forensics & Incident Response

A framework that analyzes executable files to automatically identify their malicious capabilities, such as backdoor behavior, service installation, and network communication.

Track releases GitHub Website
Python Latest v9.4.0 · 2mo ago Security brief →

Features

  • Detects ATT&CK‑mapped tactics like defense evasion, discovery, execution, exfiltration, and persistence
  • Identifies specific capabilities (e.g., file transfer over C2, shell command execution, HTTP communication)
  • Works on PE, ELF, .NET modules, and raw shellcode files

Recent releases

View all 1 releases →
v9.4.0 Security relevant
Security fixes
  • Fixed insecure YAML deserialization vulnerability
Notable features
  • PyGhidra support
  • Credential access rules
  • Improved error handling
View release on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

About

Stars
6,034
Forks
698
Languages
Python Vue JavaScript
View on GitHub Homepage Live demo Documentation

Install & Platforms

Install via
binary

Similar tools

Radare2
Rizin
Flare
Fastfinder
Ghidra

Beta — feedback welcome: [email protected]