GIAC Reverse Engineering Malware Certification (GREM)

Digital Forensics Certification Overview

Prove you can analyze Windows malware, bypass anti-analysis defenses, and reverse-engineer malicious documents and code.

Explore FOR610 Course Register for the Exam

Jump to:

Overview
Exam Objectives
Course Alignment
Who It's For
FAQs

What Is the GREM Certification?

The GIAC Reverse Engineering Malware (GREM) certification validates a practitioner's ability to examine the inner workings of malware in the context of forensic investigations, incident response, and Windows system administration. It proves the skills to reverse-engineer malicious software targeting common platforms, including Microsoft Windows and web browsers.

By the numbers

3 hrs

Exam duration

Questions

73%

Min. passing score

What GREM Covers

GREM's 15 published objectives group into six practical domains, matching FOR610's six course sections.

Malware Analysis Fundamentals

Malware Analysis Fundamentals, Static Analysis Fundamentals, and Behavioral Analysis Fundamentals.

Reversing Malicious Code

Core Reverse Engineering Concepts, Reversing Functions in Assembly, Malware Flow Control and Structures, and Common Malware Patterns.

Malicious Documents and Scripts

Analyzing Malicious Office Macros, Analyzing Malicious PDFs, and Analyzing Malicious RTF Files.

In-Depth Malware Analysis

Analyzing Obfuscated Malware, Unpacking and Debugging Packed Malware, and Examining .NET Malware.

Self-Defending Malware

Identifying and Bypassing Anti-Analysis Techniques and Overcoming Misdirection Techniques.

Capstone Application

All 15 objectives applied in a hands-on capture-the-flag tournament.

Prepare With This Course

FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques

Course Details

How FOR610 Prepares You for GREM

FOR610 is built around the exam objectives that make up the GIAC Reverse Engineering Malware (GREM) certification:

Section 1, Malware Analysis Fundamentals builds skills tested under Malware Analysis Fundamentals, Static Analysis Fundamentals, and Behavioral Analysis Fundamentals.
Section 2, Reversing Malicious Code aligns with Core Reverse Engineering Concepts, Reversing Functions in Assembly, Malware Flow Control and Structures, and Common Malware Patterns.
Section 3, Analyzing Malicious Documents and Scripts covers Analyzing Malicious Office Macros, Analyzing Malicious PDFs, and Analyzing Malicious RTF Files.
Section 4, In-Depth Malware Analysis builds toward Analyzing Obfuscated Malware, Unpacking and Debugging Packed Malware, and Examining .NET Malware.
Section 5, Examining Self-Defending Malware prepares you for Identifying and Bypassing Anti-Analysis Techniques and Overcoming Misdirection Techniques.
Section 6, Malware Analysis Tournament applies all of the above in a capstone capture-the-flag exercise against real-world malware.

Across all six sections, 48 hands-on labs and a capstone Malware Analysis Tournament give you the chance to apply each skill against real-world malware before you sit the exam.

Read the full GREM certification overview

FOR610 Authors

Lenny Zeltser

Lenny Zeltser is a cybersecurity executive with technical roots, product management experience, and a business mindset. A SANS Fellow and REMnux creator, he has built security products and programs from early stage to enterprise scale.

Learn more

Anuj Soni

Owner at Breakpoint Cybersecurity

Anuj Soni, Principal Reverse Engineer at United Healthcare, has over 15 years of experience enhancing organizational security postures. His expertise has led to the identification, containment, and remediation of multiple threat actor groups.

Learn more

Who Should Pursue GREM

Incident Responders and SOC Analysts investigating malware-driven incidents

Forensic Investigators building reverse-engineering and dynamic-analysis skills

Technologists with informal malware analysis experience looking to formalize their expertise

System and Network Administrators, Auditors, and Security Consultants protecting organizations from malicious code

Threat Intelligence Professionals extracting indicators of compromise from malware

Frequently Asked Questions

It validates a practitioner's ability to examine the inner workings of malware in the context of forensic investigations, incident response, and Windows system administration.

1 proctored exam, 66 questions, 3 hours, with a minimum passing score of 73%.

GIAC certifications are renewed on a recurring cycle through continuing education credits and a maintenance fee. For the current renewal requirements, see GIAC’s renewal page.

Incident responders, forensic investigators, technologists formalizing informal malware analysis experience, system and network administrators, and threat intelligence professionals. See the Who It's For section above for the full list.

FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques.

Ready to earn your GREM certification?

Add the GREM exam attempt when you register for FOR610.

Already trained? Register for the exam directly through GIAC here.

SEC536: Adversarial AI - Penetration Testing AI Systems