FOR610: Reverse-Engineering Malware: Malware Analysis in the Age of AI

Important - Bring Your System Configured Using These Directions

To participate in FOR610, you must bring a properly configured system that meets all requirements. Back up your system before class or use a machine without critical data. SANS is not responsible for your system or data.

Mandatory System Hardware Requirements

• CPU: 64-bit Intel i5/i7 (8th generation or newer) or AMD equivalent, with a minimum 2.0+ GHz processor. (No Apple M devices.)
• RAM: 16GB or more.
• Storage: At least 200GB of free space.
• Wireless Networking: 802.11 Wi-Fi is required as no wired internet access is available in the classroom.
• Virtualization: Ensure your BIOS settings enable virtualization (e.g., Intel-VTx or AMD-V). Verify you can access BIOS if password protected.
• Critical Note: Apple Silicon devices (M chips) cannot support necessary virtualization and are not compatible with this course.

Mandatory Host Configuration and Software Requirements

• Host OS: The latest version of Windows 11. Mac and Linux hosts are not supported.
• Local Administrator Access: This is required. Ensure you have admin rights or make arrangements for a different laptop if your company restricts access.
• VMware:
• Download and install the latest version of VMware Workstation Pro from Broadcom.
• Ensure VMware runs smoothly and can boot a virtual machine. This may require disabling Hyper-V on Windows hosts.
• Compression Tools: Install 7-Zip.
• AI Model Access: During the AI-assisted labs, you will reach a SANS-hosted AI model service over the internet. SANS provides the API key, so you do not need your own AI subscriptions or keys.

Course Media and Setup Instructions

• Download Course Media: Files can be as large as 20 GB. Start downloads as soon as the link is provided to be ready before your class starts.
• Setup Instructions: Follow the “Setup Instructions” document included with your course materials. This process may take 30 minutes or more.

If you have additional questions, please contact customer service.

FOR610: Reverse-Engineering Malware: Malware Analysis in the Age of AI is designed for cybersecurity professionals seeking to develop or enhance their malware analysis skills.

The malware analysis process taught in FOR610 helps incident responders and other security professionals assess the severity and repercussions of a situation that involves malicious software so that they can plan recovery steps. Forensics investigators also learn about the key characteristics of malware discovered during the examination, including how to establish Indicators of Compromise and obtain other threat intelligence details for analyzing, scoping, and containing the incident.

What threat does the malicious or suspicious program pose? What do its mechanics reveal about the adversary’s goals and capabilities? How effective are the company’s security controls against such infections? What security measures can strengthen the organization’s infrastructure from future attacks of this nature? This course teaches the skills necessary to answer these and other questions critical to an organization’s ability to handle malware threats and related incidents.

This course is ideal for:

• Practitioners managing incidents involving malware who need to understand its behavior and impact.
• Technologists with informal malware analysis experience looking to formalize and expand their expertise.
• Forensic investigators and IT professionals aiming to strengthen their role in the incident response process.
• Professionals in roles such as incident response, digital forensics, threat intelligence, or SOC operations who want to deepen their reverse engineering and dynamic analysis capabilities.

The GIAC Reverse Engineering Malware (GREM) certification is designed for technologists who protect the organization from malicious code. GREM-certified technologists possess the knowledge and skills to reverse-engineer malicious software (malware) that targets common platforms, such as Microsoft Windows and web browsers. These individuals know how to examine inner-workings of malware in the context of forensic investigations, incident response, and Windows system administration. Become more valuable to your employer and/or customers by highlighting your cutting-edge malware analysis skills through the GREM certification.

• Malware Analysis Using Malware Code and Behavioral Analysis Fundamentals
• Windows Assembly Code Concepts for Reverse Engineering and Common Windows Malware Characteristics in Assembly
• In-Depth Analysis of Malicious Executables and Self-Defending Malware
• Analysis of Malicious Document Files, .NET programs, and Protected Executables

More Certification Details

• Electronic toolkit with essential malware analysis tools
• Windows REM Workstation VM with analysis tools and a Windows license
• REMnux Linux VM for malware analysis
• AI agent tooling on REMnux, with access to a SANS-hosted AI model service during the labs
• Real-world malware samples for labs
• MP3 recordings of course lectures
• Electronic workbook with step-by-step lab instructions

To ensure a successful learning experience in the FOR610: Reverse-Engineering Malware course, attendees should meet the following prerequisites:

• Laptop Requirements: Bring a system that meets the stated hardware and software requirements, with the necessary pre-class installations completed.
• Operating System Proficiency: Be familiar with both Windows and Linux environments, including basic troubleshooting of connectivity and setup issues.
• Basic Programming Concepts: Understand core programming principles such as variables, loops, and functions to grasp relevant concepts quickly, though prior programming experience is not required.

FOR610: Reverse-Engineering Malware is a core component of the Threat Intelligence and Forensics Learning Path. This training complements the skills taught in FOR578: Cyber Threat Intelligence, offering a well-rounded foundation in malware analysis and threat investigation.

Other complementary areas of training include endpoint-focused forensics, network-focused forensics, and media exploitation, enabling practitioners to broaden their expertise in digital forensics and incident response.

Reverse engineering malware means examining malicious software to determine what it does and what threat it poses. This course uses that term and malware analysis interchangeably. Malware is part of many cybersecurity incidents. Knowing how to analyze it lets you take control of the incident and speed up your response.

Why it matters:

• Threat assessment: Determine what the malware can do and what its mechanics reveal about the adversary’s goals and skill
• Incident scope: Establish indicators of compromise to find every affected system
• Eradication and recovery: Know which artifacts to remove and how to contain the incident
• Stronger defenses: Turn what you learned from the incident into defenses against the next attack
• AI-assisted analysis: Use an AI agent for a fast first pass and to go deeper and broader than you could alone, then verify its findings with independent methods

FOR610 gives you practical skills that employers can see in your work.

• Analysis depth: Handle investigations that used to require a senior reverse engineer, with AI tooling extending your reach
• Accountable conclusions: Verify what automated tools and AI agents report, so you can defend your findings during an incident
• Broader role: Contribute malware insights to incident response, forensics, threat intelligence, and SOC work
• Recognition: Prepare for the GIAC Reverse Engineering Malware (GREM) certification