CAPA¶ binary Identifies capabilities (persistence, C2, etc.) in a binary automatically. Location¶ /usr/local/bin/capa How to run¶ capa sample.exe Part of the Malware & Forensics toolset in DetectOps.