CAPA: The Basics: Static Malware Analysis and MITRE ATT&CK Mapping

Introduction

Welcome to my walkthrough of the room CAPA: The Basics! We are continuing through the Defensive Security Tooling module of the Cyber Security 101 path.

In my previous article, CyberChef: The Basics, we used a browser based tool to manually decode and extract data from raw strings. This time we move into static malware analysis with CAPA, a command line tool that reads an executable file and tells us, in plain terms, what it is capable of doing, without ever running the file itself.

Catch up on my previous article, CyberChef: The Basics, by clicking the banner below.

What we will cover

• What CAPA is and why static analysis matters when handling potentially malicious files
• How to run CAPA and interpret its -h, -v, and -vv output
• How to read the general information block alongside MITRE ATT&CK mappings
• How the Malware Behavior Catalogue (MBC) organizes objectives, behaviors, and methods
• How CAPA's namespaces group related capabilities together
• How to dig into individual rule YAML files and the CAPA Web Explorer
• Answers to every question in the room

Room Information

Before we dive into the tasks, here is a quick overview of the room details.

• Room Name: CAPA: The Basics
• Path: Cyber Security 101
• Module: Defensive Security Tooling
• Topic: CAPA, Static Malware Analysis, MITRE ATT&CK, Malware Behavior Catalogue
• Difficulty: Easy
• Room Link: TryHackMe — CAPA: The Basics

Task 1: Introduction

Analyzing potentially malicious software carries risk. Running the sample gives us the clearest picture of its behavior, but it also risks compromising our machine unless we are working inside a proper sandbox or an isolated environment. That risk is exactly why static analysis, examining a file without executing it, has its place alongside dynamic analysis, and it is what this room focuses on through a tool called CAPA.

CAPA (Common Analysis Platform for Artifacts) was developed by the FireEye Mandiant team to identify the capabilities present in executable files such as Portable Executables (PE), ELF binaries, .NET modules, shellcode, and even sandbox reports. It works by comparing the file against a large set of rules describing common behaviors, such as network communication, file manipulation, or process injection, and reporting back which ones matched.

What makes CAPA especially valuable is that it packages years of reverse engineering expertise into a single automated tool. An analyst does not need to be a seasoned reverse engineer to get a useful, high level read on what a binary can do, which makes CAPA a strong first step in malware analysis and threat hunting workflows. Some familiarity with the MITRE ATT&CK framework is recommended before starting, since CAPA maps its findings directly onto that framework's tactics and techniques.

Task 2: Tool Overview: How CAPA Works

Running CAPA is a three step process: open a terminal, make sure you are in the directory containing the binary, then run capa or capa.exe pointed at the file. Against a sample like cryptbot.bin, the tool loads its rule set (485 rules in this case), analyzes the binary, and prints a series of tables covering file metadata, ATT&CK mappings, MBC mappings, and the specific capabilities it detected.

Beyond the default output, CAPA supports a handful of useful flags. -h or — help prints the help message and available parameters. -v or — verbose produces a more detailed result document, and -vv or — vverbose goes even further with a very verbose result document, at the cost of longer processing time. Since a full run can take several minutes, the room provides pre-processed output saved as cryptbot.txt, which can be read instantly with the PowerShell command Get-Content rather than waiting on a live run.

Guided Walkthrough: Running CAPA and Reading Its Help Output

Open a PowerShell terminal on the lab machine and run ls once you are in C:\Users\Administrator\Desktop\capa, just to confirm the sample files are actually there before doing anything else. From there, run capa with the help flag against the tool itself rather than against a specific file. The usage line and the optional arguments section that follow list out every flag CAPA supports, including the exact short forms for both verbosity levels, so there is no need to run a full scan just to answer the first three questions.

The last question is not something CAPA's help output tells you at all, since it is a plain PowerShell question rather than a CAPA one. Go back to the task description itself, where the specific PowerShell command used to print a file's contents to the terminal is named directly, and use that same command whenever you need to read one of the pre-processed report files later in the room.

Questions and Answers

What command-line option would you use if you need to check what other parameters you can use with the tool? Use the shortest format.

Answer:

-h

-h

What command-line options are used to find detailed information on the malware's capabilities? Use the shortest format.

Answer:

-v

-v

What command-line options do you use to find very verbose information about the malware's capabilities? Use the shortest format.

Answer:

-vv

-vv

What PowerShell command will you use to read the content of a file?

Answer:

Get-Content

Get-Content

Task 3: Dissecting CAPA Results Part 1: General Information, MITRE and MAEC

The first block CAPA prints covers basic file metadata: the md5 and sha1~/~sha256 hashes, an analysis field describing how the file was examined, an os field showing the operating system context, an arch field for the target architecture, and a path showing where the file was found on disk.

From there, CAPA maps its findings onto the MITRE ATT&CK framework, a global knowledge base documenting the tactics and techniques threat actors use at every stage of an attack. CAPA presents this as ATT&CK Tactic::ATT&CK Technique::Technique Identifier, with an optional sub-technique layer added in as ATT&CK Tactic::ATT&CK Technique::ATT&CK Sub-Technique::Technique Identifier.Sub-technique Identifier. Seeing a file's behavior mapped this way helps an analyst quickly place it within the broader context of an attacker's playbook.

Alongside ATT&CK, CAPA also reports a MAEC (Malware Attribute Enumeration and Characterization) value, a standardized language for describing malware behaviors, artifacts, and relationships between samples. Two of the most common values are launcher, for files that trigger malware like actions such as dropping payloads or establishing persistence, and downloader, for files that fetch and execute additional payloads or resources from the internet.

Guided Walkthrough: Reading the Metadata and ATT&CK Tables

Read the pre-processed report from Task 2 with Get-Content cryptbot.txt, and look at the very first table at the top of the results. Each row is labeled clearly, so finding the specific hash value the question asks for is a matter of matching the row label to the correct field. From there, scroll down slightly to the ATT&CK Tactic and ATT&CK Technique table and look specifically at the Defense Evasion row. The technique name is followed by its identifier in square brackets, and the sub-technique listed directly underneath it carries its own identifier the same way.

The last two questions are not part of that terminal output at all, since the sample run only ever tagged this particular file with one MAEC value. Instead, go back to the task's own description of MAEC values, which lays out a bullet list of behaviors under both launcher and downloader. Match the specific behavior phrased in each question against those two lists rather than looking for it in the scan results, and the MAEC value it belongs to is your answer.

Questions and Answers

What is the sha256 of cryptbot.bin?

Answer:

ae7bc6b6f6ecb206a7b957e4bb86e0d11845c5b2d9f7a00a482bef63b567ce4c

ae7bc6b6f6ecb206a7b957e4bb86e0d11845c5b2d9f7a00a482bef63b567ce4c

What is the Technique Identifier of Obfuscated Files or Information?

Answer:

T1027

T1027

What is the Sub-Technique Identifier of Obfuscated Files or Information::Indicator Removal from Tools?

Answer:

T1027.005

T1027.005

When CAPA tags a file with this MAEC value, it indicates that it demonstrates behaviour similar to, but not limited to, Activating persistence mechanisms?

Answer:

launcher

launcher

When CAPA tags a file with this MAEC value, it indicates that the file demonstrates behaviour similar to, but not limited to, Fetching additional payloads or resources from the internet?

Answer:

Downloader

Downloader

Task 4: Dissecting CAPA Results Part 2: Malware Behavior Catalogue

The Malware Behavior Catalogue (MBC) is a catalogue of malware objectives and behaviors, used to support labeling, similarity analysis, and standardized reporting. MBC content follows one of two formats: OBJECTIVE::Behavior::Method[Identifier] when a method is present, or the shorter OBJECTIVE::Behavior::[Identifier] when it is not. MBC content complements MITRE ATT&CK rather than duplicating it, so behavior names may or may not line up exactly with ATT&CK technique names.

Three levels sit underneath MBC. The Objective is loosely based on ATT&CK tactics but tailored specifically to malware characterization, and includes categories unique to MBC such as Anti-Behavioral Analysis and Anti-Static Analysis. Below that, Behaviors and Micro-Behaviors describe more specific actions such as creating a process, allocating memory, or checking a string, each carrying its own identifier. Finally, Methods describe a further sub-technique tied to a specific behavior, such as encoding data specifically with Base64 rather than XOR.

Working through an example makes this concrete: a result showing DATA::Encode Data::Base64 [C0026.001] tells us the file's Objective is data related, its Behavior is encoding data, its Method is specifically Base64, and its identifier is C0026.001. Put simply, that single row tells us the file is capable of using Base64 encoding.

Guided Walkthrough: Matching Behaviors to Identifiers

The first question in this task is not something the CAPA output shows at all, since it is asking about MBC itself rather than a specific scan result. Its answer sits right in the task's own opening description, where MBC is introduced by name as a catalogue of malware objectives and behaviors.

For the rest of the questions, open the MBC table from CAPA's output and work through it column by column. The table header itself tells you what the left hand column represents, which is exactly what the second question is asking about. From there, look at the row for anti behavioral analysis to find the specific behavior name tied to identifier B0009, look at the process row to find the identifier tied to Create Process, and check the communication and data rows for the two remaining micro-behavior questions, one covering HTTP related activity and the other covering base64 and XOR encoding.

Questions and Answers

What serves as a catalogue of malware objectives and behaviours?

Answer:

Malware Behavior Catalogue

Malware Behavior Catalogue

Which field is based on ATT&CK tactics in the context of malware behaviour?

Answer:

Objective

Objective

What is the Identifier of "Create Process" micro-behavior?

Answer:

C0017

C0017

What is the behaviour with an Identifier of B0009?

Answer:

Lab Machine Detection

Lab Machine Detection

Malware can be used to obfuscate data using base64 and XOR. What is the related micro-behavior for this?

Answer:

Encode Data

Encode Data

Which micro-behavior refers to "Malware is capable of initiating HTTP communications"?

Answer:

HTTP Communication

HTTP Communication

Task 5: Dissecting CAPA Results Part 3: Namespaces

The final major block in CAPA's output pairs each detected Capability (essentially the name of the matching rule) with a Namespace, following the format Capability(Rule Name)::TLN(Top-Level Namespace)/Namespace. Namespaces exist so CAPA can group rules that serve a similar purpose, even when the specific capabilities they detect are quite different from one another.

Several Top-Level Namespaces show up repeatedly across CAPA scans. anti-analysis covers rules built to detect malware attempting to evade analysis through obfuscation or anti-debugging tricks. communication covers network related behaviors such as sending or receiving data. persistence covers behaviors aimed at surviving on a compromised system over time. nursery, meanwhile, is simply a staging area for rules that have not yet been fully polished, and lib holds building blocks used to construct other rules rather than standalone detections.

Within a Top-Level Namespace, capabilities are further grouped by a more specific namespace, for example anti-vm/vm-detection sitting underneath anti-analysis, gathering together every rule concerned with detecting virtual machine artifacts specifically.

Guided Walkthrough: Reading Namespace Descriptions

Unlike some of the earlier tasks, none of the answers here come from redacted values inside a scan result. Every question in this task is really asking you to match a description back to its namespace or Top-Level Namespace name, and those descriptions live directly in the task's own reference tables rather than in the scan output itself.

The screenshot below shows the full Capability and Namespace table from a CAPA run, which is useful context for seeing how capabilities are grouped under their namespace paths, but it will not hand you any of the five answers directly. Instead, read through the Top-Level Namespace explanations given earlier in the task, matching the specific wording in each question (detecting VM environments, maintaining persistence, obfuscating code, or being an unpolished staging area) against the definition it lines up with.

Questions and Answers

Which top-level Namespace contains a set of rules specifically designed to detect behaviours, including obfuscation, packing, and anti-debugging techniques exhibited by malware to evade analysis?

Answer:

anti-analysis

anti-analysis

Which namespace contains rules to detect lab machine (VM) environments? Note that this is not the TLN or Top-Level Namespace.

Answer:

anti-vm/vm-detection

anti-vm/vm-detection

Which Top-Level Namespace contains rules related to behaviours associated with maintaining access or persistence within a compromised system? This namespace is focused on understanding how malware can establish and maintain a presence within a compromised environment, allowing it to persist and carry out malicious activities over an extended period.

Answer:

persistence

persistence

Which namespace addresses techniques such as String Encryption, Code Obfuscation, Packing, and Anti-Debugging Tricks, which conceal or obscure the true purpose of the code?

Answer:

obfuscation

obfuscation

Which Top-Level Namespace Is a staging ground for rules that are not quite polished?

Answer:

Nursery

Nursery

Task 6: Dissecting CAPA Results Part 4: Capability

Continuing from the previous task, each row in the Capability and Namespace table also corresponds to a specific rule YAML file on disk. As a naming convention, the capability's display name and its rule file are the same, just with dashes inserted between words and a .yml extension added, so reference anti-VM strings corresponds to reference-anti-vm-strings.yml.

There are exceptions to how neatly a capability maps to its expected Top-Level Namespace on disk. A capability like reference cryptocurrency strings looks like it should live under Impact based on its behavior, but its rule file is actually stored under Nursery, since the rule has not yet been promoted out of that staging area. Recognizing this distinction matters if you ever go digging through CAPA's rule repository directly rather than relying on the tool's own output.

Guided Walkthrough: Matching Capabilities to Rule Files and Reading a Rule on GitHub

The first three questions here can all be worked out from the tables and text already covered in this task and the previous one. Apply the dash naming convention described above to move between a capability's display name and its expected rule file name, and check the Capability table for which Top-Level Namespace a given capability, such as run PowerShell expression, falls under.

The last question is different, since it sends you outside the room entirely to the linked GitHub repository. Follow the link to the rule file check-for-windows-sandbox-via-registry.yml and open it to view its contents directly. Scroll down to the features section, which lists the specific Windows API calls and registry values CAPA checks for, and look for the one API entry that ends in Ex.

Questions and Answers

What rule yaml file was matched if the Capability or rule name is check HTTP status code?

Answer:

check-http-status-code.yml

check-http-status-code.yml

What is the name of the Capability if the rule YAML file is reference-anti-vm-strings.yml?

Answer:

reference anti-VM strings

reference anti-VM strings

Which TLN or Top-Level Namespace includes the Capability or rule name run PowerShell expression?

Answer:

load-code

load-code

Check the conditions inside the check-for-windows-sandbox-via-registry.yml rule file from this link. What is the value of the API that ends in Ex is it looking for?

Answer:

RegOpenKeyEx

RegOpenKeyEx

Task 7: More Information, More Fun!

Knowing that a rule matched is useful, but understanding exactly why it matched is even more valuable, and that is where the -vv (very verbose) flag comes in. Running CAPA with -vv produces a much larger result document, one detailed enough that a text editor or terminal alone becomes an impractical way to browse it, easily running to several thousand lines for a single sample.

To make that volume of information manageable, CAPA supports exporting results as JSON using the -j flag alongside -vv, which can then be loaded into the CAPA Web Explorer, available both online and as an offline HTML page. Once a JSON report is uploaded, the Web Explorer presents each matched capability alongside the exact rule conditions and string patterns that triggered it, along with a global search box for filtering results across the entire report.

Guided Walkthrough: Exporting Results and Exploring Them Visually

Rather than waiting on a live -vv run against cryptbot.bin, think back to the options table from Task 2 and note which single character flag, used alongside -vv, tells CAPA to export its results as JSON rather than printing them to the terminal.

Once you have a JSON report in hand, whether your own or the pre-processed cryptbot_vv.json, open the offline HTML page on the lab machine to load the Web Explorer's landing page, then use its upload option to load the file in.

Once the report finishes loading, take a moment to explore the analysis view rather than jumping straight to the questions. Notice the summary bar across the top showing counts for rules, namespaces, and functions, and look for the box near the top left of the results table that lets you filter everything shown below it by keyword.

Questions and Answers

Which parameter allows you to output the result of CAPA into a .json file?

Answer:

-j

-j

What tool allows you to interactively explore CAPA results in your web browser?

Answer:

CAPA Web Explorer

CAPA Web Explorer

Which feature of this CAPA Web Explorer allows you to filter options or results?

Answer:

Global Search Box

Global Search Box

Summary & Key Takeaways

CAPA turned a wall of reverse engineering knowledge into something approachable, letting us pull real signal out of an unfamiliar binary without ever having to run it. Between the general metadata, the ATT&CK and MBC mappings, and the namespace grouped capability list, we now have a repeatable way to size up a suspicious file quickly and know where to dig deeper if something looks worth a closer look.

Key lessons:

• CAPA performs static analysis by matching a binary against a large library of behavior rules, without ever executing the file
• -h, -v, and -vv control how much detail CAPA's output includes, with more detail costing more processing time
• CAPA maps its findings onto both the MITRE ATT&CK framework and the Malware Behavior Catalogue (MBC), giving two complementary views of the same behavior
• Namespaces group related capabilities together, and a capability's rule filename can usually be derived just by replacing spaces with dashes
• The CAPA Web Explorer turns an overwhelming very verbose JSON report into something searchable and easy to browse

Next up is REMnux: Getting Started, where we set up a Linux toolkit purpose built for reverse engineering and analyzing malicious software. Click the banner below to check it out!

If you found this walkthrough helpful, consider following me here on Medium to catch the next room analysis in this series.

You can also connect with me and follow my work across other platforms:

• 💼 LinkedIn:
• 🐦 X (Twitter):