capa rules — authorized orientation
capa rules are the capability-oriented signatures that capa (mandiant/capa, Apache-2.0) matches against features extracted from executables you may analyze. Treat rule hits as hypotheses, not verdicts.
Snapshot
| Field | Value |
|---|---|
| Engine | capa (see overview) |
| Rules home | mandiant/capa-rules (upstream) |
| License | Apache-2.0 (confirm per file) |
| Peers | YARA, FLOSS, DiE |
Allowed framing
- Teaching students to read a rule (meta/namespaces/features) before trusting a finding name.
- Pinning capa version + rules commit in CI for reproducible course labs.
- Writing a tiny lab-local rule that matches a student-built sample feature — reviewed by the instructor.
Scope we will not cover
- No malware packing "to trigger capa" weaponization guides.
- No exploit / shellcode cookbooks disguised as rule authoring.
- No crack/keygen or DRM-bypass rule packs.
- No claiming a single rule match proves attribution in court.
Beginner path (authorized only)
- Finish capa overview on a PE/ELF you own or a licensed corpus.
- Open one matched rule file from the rules pack your install used; note namespace and features.
- Re-run with rules pinned; archive JSON + capa/rules versions.
- Compare with YARA when the org needs custom pattern packs instead of capability language.
- Escalate interesting hits into Ghidra/Cutter/IDA — rules suggest, humans verify.
- Use capa rules orientation to keep capability findings reproducible and honest.
- Prefer pinned packs and instructor-reviewed lab-local rules over random internet dumps.
- Refuse malware packaging, exploit and crack framing.
For legal, authorized and educational use only.
FAQ
How is this different from capa-overview-authorized?
The overview covers capa the product (install, report shapes, version honesty). This page zooms on rules — packs, namespaces, nursery noise and lab-local rule hygiene.
Where do official rules live?
Upstream maintains a dedicated capa-rules repository consumed by capa releases. Pin both the capa binary version and the rules commit/tag in every report — they can move independently.
Nursery vs production rules?
Experimental/nursery-class rules are often noisier. Prefer mature namespaces for graded labs; document when you intentionally enable noisier packs.
Can I write my own capa rules?
Yes for authorized lab corpora, under Apache-2.0 project norms and your org review. Do not publish rules whose sole purpose is DRM defeat or pirate unlock detection theater.
Does this teach packing malware or exploit kits?
No. Authorized analysis and education only — BinBench will not supply malware packaging, exploit PoCs or crack cookbooks.