capa

Static capability detection for binaries — maps code behavior to ATT&CK/MBC without execution.

Installation

# Standalone binary (recommended — no Python deps)
# Download from: https://github.com/mandiant/capa/releases
# Linux
wget https://github.com/mandiant/capa/releases/latest/download/capa-v7.x.x-linux.zip
unzip capa-*.zip && chmod +x capa

# Windows: download capa.exe from releases

# Python package
pip install capa