Welcome to capa-rules Discussions!

[williballenthin]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we build together 💪.

(this is willi:) I've clicked through the default Discussions config to create this. Let's see what we can use this Github feature for.

[Dextera0007]

Learning capa rules, objective is to analyze various packets using capa rules: PE, ELF and .net files any help you can provide would be greatly appreciated. Here are the errors below when attempting to run a PE files :

capa -s capa-master\sigs -r capa-rules-master file.exe
error:capta: Input file does not appear to be a PE file or ELF file
error:capa: capa currently only supports analyzing PE and ELF files (or shellcode, when using --fomrat sc32|sc64

[mr-tz]

Please open an issue here: https://github.com/mandiant/capa/issues and share the file hash (if possible).

[Iroxious]

Thank you very much for your contributions.
May I ask if you have any plans in the near future to synchronize capa rules with ATT&CK v14.1?

[mr-tz]

Thank you, tracking here: #887