agentsclimarketplace
Sign in

Generating capability reports with capa

Skill meltedinhex/analyst-ai-pack/skills/generating-capability-reports-with-capa

Uses capa to identify malware capabilities from a binary: running rule-based detection over disassembly, mapping matched capabilities to MITRE ATT&CK and MBC, and interpreting results to focus deeper analysis. Activates for requests to run capa, generate a capability report, or map a sample's behaviors to ATT&CK automatically.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill generating-capability-reports-with-capa

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.0 KB, 496 tokens by cl100k_base, as published. Nobody here has run it

Generating Capability Reports with capa

When to Use

  • You want an automated, rule-based read of what a binary can do before manual reversing.
  • You need capabilities mapped to MITRE ATT&CK and the Malware Behavior Catalog (MBC).
  • You are prioritizing which functions to reverse based on detected capabilities.

Do not use capa results as a behavioral guarantee — it detects potential capabilities from code patterns; packed samples must be unpacked first or capa sees only the stub.

Prerequisites

  • capa installed; the sample handled inertly in the lab.
  • For packed samples, an unpacked dump (see the unpacking skills) before running capa.

Safety & Handling

  • capa performs static analysis; it does not run the sample. Still handle the sample inertly.
  • Keep the sample password-protected at rest and reference it by hash.

Workflow

Step 1: Confirm the sample is analyzable

Verify it is not packed (entropy/imports). If packed, unpack and run capa on the dump, not the stub.

Step 2: Run capa and capture results

Generate the capability report, ideally in JSON for programmatic use plus the human view.

capa -j sample.exe > capa.json
python scripts/analyst.py summarize capa.json

Step 3: Map to ATT&CK and MBC

Group matched rules by ATT&CK technique and MBC behavior to see the sample's capability profile (e.g., persistence, injection, C2, anti-analysis).

Step 4: Prioritize deeper analysis

Use the function addresses capa reports to jump straight to the most interesting code in your disassembler.

Validation

  • capa was run on unpacked code, not a packer stub.
  • Detected capabilities are corroborated by imports/strings before being trusted.
  • The ATT&CK/MBC mapping focuses subsequent manual reversing on real functionality.

Pitfalls

  • Running capa on a packed sample and concluding "few capabilities".
  • Treating a capa match as confirmed behavior rather than potential capability.
  • Ignoring the reported addresses that pinpoint where to reverse.

References

What ships with it: 3 files

3.2 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.