ScriptIOC-Bench: leaderboard
Recognising actionable indicators of compromise in script-based malware (JavaScript, PowerShell, VBScript, shell), where the IOC often has to be recovered through decoding steps; overall micro-averaged F1 over IOC instances, response failures counted as empty. Rule-based extractors are not published. Higher is better. Source: arxiv.org/abs/2609.06149.
Metric: Micro-F1 (%). Source: arxiv.org. Saturation forecast: Around February 2027. 10 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | GPT-5.6 Terra | 65.4 | #40 |
| 2 | Gemini 2.5 Pro | 65 | #159 |
| 3 | Gemini 2.5 Flash | 61.6 | #255 |
| 4 | Qwen 3 Coder 480B A35B Instruct | 49.8 | #314 |
| 5 | Qwen 3.6 35B A3B | 47.5 | #238 |
| 6 | Qwen3 Coder Next | 44.2 | #331 |
| 7 | Llama 4 Scout Instruct | 34 | #547 |
| 8 | Qwen 3 8B | 28.7 | #678 |
| 9 | Ministral-3-8B-Instruct-2512 | 27.5 | #663 |
| 10 | gemma-4-E4B-it | 21.8 | #577 |
No result here: #3 Claude Opus 5.5, #6 GPT-6 Astra, #7 GPT-6.1 Sol.
Interactive version: theaggregate.ai/benchmark?slug=scriptioc-bench · How It Works · Data refreshed daily, snapshot 2026-11-05.