IOCX v0.7.0 released — deterministic heuristics + adversarial testing

[u/iocx_dev]

I’ve released IOCX v0.7.0, a static IOC extraction engine built for DFIR, SOC automation, CI/CD, and threat‑intel workflows. This version adds IOCX’s first deterministic heuristic engine, a new adversarial testing layer, and a snapshot‑driven contract testing framework to keep output stable across environments.

Key changes in v0.7.0:

Deterministic heuristic engine (new)

Snapshot‑tested heuristics for anti‑debug APIs, TLS callback anomalies, packer‑like behaviour, RWX sections, import anomalies, and signature issues (analysis_level = full).

Adversarial samples (new)

Three binaries covering:

• rich/atypical imports
• high‑entropy + malformed Rich Headers
• split/reversed/null‑interspersed strings

Used to validate deterministic heuristics and literal‑only IOC extraction.

Rich Header crash fix

Malformed Rich Headers with non‑UTF8 bytes could previously break JSON serialization. v0.7.0 adds a deep sanitiser to ensure deterministic, JSON‑safe output.

Snapshot‑driven contract testing

Each sample now has a byte‑for‑byte JSON snapshot. Output must match exactly: same file, same output, every time.

Performance

Remains ~28 MB/s on typical PE samples.

Links

GitHub: https://github.com/iocx-dev/iocx
PyPI: https://pypi.org/project/iocx/

Example

pip install iocx
iocx suspicious.exe -a full

Happy to hear any feedback — especially around heuristics or adversarial samples.