Skip to content
CertGPS

GIAC Reverse Engineering Malware

Proves you can reverse-engineer Windows malware and malicious documents with disassemblers and debuggers, including unpacking samples and defeating anti-analysis tricks

ExpertGIAC

The exam

Exam cost
$999
Study time
6-9 months
Passing score
73%
Valid for
4 years

Before you book

  • None listed by GIAC
  • Recommended: familiarity with Windows and Linux, VMware, and basic programming concepts (per SANS FOR610)

What it covers

Security domains

Skills

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

    • Principal Researcher
    • Director of Threat Intelligence

Where it leads

  1. GIAC Certified Forensic Analyst

    Advanced

    Comes before. Shows where malware ran, persisted and what it touched across an enterprise intrusion

  2. GIAC Certified Incident Handler

    Intermediate

    Comes before. Covers the incident handling process that malware analysis findings feed into

  3. GIAC Reverse Engineering Malware

    You are here

Study guide

Last updated

GIAC GREM Study Guide: Reverse-Engineering Malware and FOR610

GREM certifies that you can take a malicious Windows program or document apart and explain what it does, from static triage and lab behavior through assembly, unpacking and anti-analysis tricks. It's GIAC's exam for SANS FOR610: 66 questions, three hours, $999. Its 73% pass mark is higher than GIAC sets for GCFE, GCFA or GNFA, so build in a margin when you judge your practice scores.

Who GREM is for, and who should take a different exam

GIAC's list is broad: system and network administrators, auditors, security consultants and managers, forensic investigators, and anyone who has handled incidents involving malware. The people who get the most from it are incident responders and threat intelligence analysts who keep sending samples to someone else and want to do the work themselves. FOR610 is rated advanced by SANS, but its stated prerequisites are modest: comfort with Windows and Linux, experience importing virtual machines in VMware, and basic programming concepts such as variables, loops and functions. SANS says prior programming experience isn't required.

If your interest is finding and writing exploits rather than analyzing malware, OSED is the closer match. If you need to spot malware inside an investigation but not reverse it, GCFA covers detection in memory and on disk. And if incident handling itself is new to you, GCIH gives you the process that malware findings feed into.

GREM exam facts

ItemGREM
FormatOne proctored exam with CyberLive hands-on tasks in a virtual machine
Questions and time66 questions, 3 hours
Passing score73% (exam versions released on or after August 27, 2022)
Price$999 per attempt; $899 retake; $399 practice test
DeliveryRemote through ProctorU or on site at Pearson VUE, within 120 days of activation
Reference materialOpen book: printed books, notes and an index; no electronic files
PrerequisitesNone listed by GIAC
Validity and renewalFour years; 36 CPEs or a retake, plus a $499 renewal fee

What the fifteen objectives cover

GIAC lists fifteen objectives without weights. SANS maps them onto FOR610's first five sections, which is the clearest way to read them:

  • Fundamentals: Malware Analysis Fundamentals, Static Analysis Fundamentals, Behavioral Analysis Fundamentals
  • Code: Core Reverse Engineering Concepts, Reversing Functions in Assembly, Malware Flow Control and Structures, Common Malware Patterns
  • Documents: Analyzing Malicious Office Macros, Analyzing Malicious PDFs, Analyzing Malicious RTF Files
  • Protected code: Analyzing Obfuscated Malware, Unpacking and Debugging Packed Malware, Examining .NET Malware
  • Self-defending malware: Identifying and Bypassing Anti-Analysis Techniques, Overcoming Misdirection Techniques

Assembly is the largest block, four objectives on reading x86 and x64 code: function parameters, loops and conditionals, control flow, and the Windows API calls malware tends to use. Practice until you can look at a disassembly listing and say what a function returns or which call opens the network connection. The document objectives are narrower than they sound, covering Office macros, PDFs and RTF files with embedded shellcode; the course also teaches deobfuscating JavaScript and PowerShell. GIAC frames the scope as malware targeting Windows and web browsers, and the objectives don't mention Linux, macOS or mobile samples.

GIAC places the CyberLive section at the end of the exam and says candidates who can't answer a majority of those items shouldn't expect to pass. It doesn't say how many hands-on items GREM has.

How to prepare

FOR610, by Lenny Zeltser and Anuj Soni, runs six days in class or 36 hours self-paced, with 48 labs and a capture-the-flag tournament as the capstone. Students work in a Windows virtual machine and REMnux, the Linux malware analysis distribution, using Ghidra for static code analysis and x64dbg for debugging. Check the laptop requirement before you register: SANS asks for a 64-bit Intel i5 or i7 of 8th generation or newer, or an AMD equivalent, and rules out Apple M-series machines. Buying the GIAC attempt with the course adds two practice tests.

Assembly takes longest, so start it first. Spend the first few weeks in Ghidra on small, known programs you compile yourself, then on real samples, until you can name a function's purpose from its calls and loops without stepping through it. After that, cycle through the other blocks with REMnux: macro extraction on Office files, stream analysis on PDFs, shellcode carved out of RTF documents, then unpacking a packed executable in x64dbg by finding the jump to the original entry point.

For extra reading, Practical Malware Analysis by Michael Sikorski and Andrew Honig (No Starch Press, 2012) is still a good grounding in method, though it teaches IDA Pro and OllyDbg rather than the Ghidra and x64dbg you'll use in FOR610. Lenny Zeltser's free cheat sheet for analyzing malicious software is worth printing for the exam. Index the course books by technique and by API name, since one objective is about recognizing the API calls malware commonly uses. Keep one practice test for the last week. A failed attempt means a 30-day wait and an $899 retake.

Renewal and next steps

GREM lasts four years. Renew with 36 CPEs or by retaking the exam, and pay a $499 fee each cycle; another GIAC renewal within two years of a full-price one costs $249. SANS courses can provide all 36 CPEs, while work experience, cyber ranges and NetWars are capped at 12 each.

Where to go next:

  • GCFA puts malware analysis in the context of an enterprise intrusion: where the sample ran, how it persisted, what it touched.
  • OSED if reading assembly made you want to write exploits too.

Our view

GREM is the GIAC credential for malware analysis, and its objectives describe the actual job: lab setup, static and dynamic analysis, unpacking, anti-debugging. SANS says thousands of analysts got their start in FOR610. The weak spot is the question format outside the CyberLive section, since recognizing the right answer about a disassembly listing is easier than reversing an unfamiliar sample cold, and the hands-on tasks only partly close that gap. With the attempt at $999 and SANS listing FOR610 at $8,780, it's worth it when malware analysis is or will be part of your role. As a general security credential, it's specialized and expensive.

Sources