capa: Capabilities to ATT&CK
- capa (Mandiant) identifies what a program can do by matching curated rules against disassembly.
- Output: capabilities like "inject code," "encrypt data," "communicate over HTTP," "achieve persistence via Run key."
- Maps findings to MITRE ATT&CK techniques and MBC (Malware Behavior Catalog).
- Answers "what does this do?" before you read a single function.
Key Takeaway
capa gives you a capability + ATT&CK summary in seconds —- a great starting map for Ghidra.