capa on a Mac
Detect capabilities in executables (self-hosted) · Security Tools
capa (Mandiant/FLARE) identifies what a program CAN do; it maps a PE/ELF/Mach-O/shellcode sample to ATT&CK techniques and capabilities (e.g. 'create TCP socket', 'encrypt data', 'persist via run key') using a rule set. pip install flare-capa, then capa suspicious.exe. Great first-pass static triage before deeper RE.
Run capa with FrontierStack
Install or connect capa; then check its status, ports and certificate from FrontierStack. The same screen links to firewall checks, Malware Audit and backups where they apply.
Run it from your Mac.
FrontierStack installs, monitors and secures services on this Mac and on linked servers.
Download FrontierStackApple notarized · Safe & secure · macOS 13 Ventura+