capa

Static capability detection for binaries — maps code behavior to ATT&CK/MBC without execution.

Installation

# Standalone binary (recommended — no Python deps)
# Download from: https://github.com/mandiant/capa/releases
# Linux
# Download the Linux archive for your architecture from the release page.
unzip capa-*.zip && chmod +x capa

# Windows: download capa.exe from releases

# Python package
pip install capa