Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by GIAC
Exam Format
180 min
66
73%
Advanced
Registration
$999 USD
ProctorU (remote proctoring), PearsonVUE (onsite proctoring), or online proctoring
Validity
4 years
Earn 36 Continuing Professional Education (CPE) credits; Retake the GREM exam; Pass another GIAC certification at the same or higher level
GREM Exam Topics and Domains
GREM is organized into 6 weighted domains. Expect to work with Ghidra, IDA Pro, Advapi32.dll, API Monitor, and more.
1
Malware Analysis Fundamentals
10%
Key Methods for Analyzing Malicious Software
Static Analysis TechniquesBehavioral Analysis TechniquesCode Analysis Techniques
- Describe key methods for analyzing malicious software
- Identify the needs of a malware analysis lab
- Understand when to apply static, behavioral, or code analysis techniques
Malware Analysis Lab Setup
Virtual Machine ConfigurationAnalysis Toolkit Assembly
- Assemble a toolkit for effective malware analysis
- Configure isolated lab environments for safe malware analysis
- Implement proper network controls and monitoring
2
Windows Assembly Code Concepts and Reverse Engineering
20%
x86 and x64 Assembly Language Fundamentals
Registers and Memory ArchitectureCommon Assembly Instructions
- Interpret common x86 and x64 assembly instructions
- Understand register usage in Windows malware
- Recognize 64-bit code peculiarities
Control Flow Analysis
Conditional Statements in AssemblyLoops in AssemblyFunction Calls and Returns
- Analyze common execution flow control mechanisms in assembly language
- Identify loops and conditional statements in disassembled code
- Understand function calling conventions and parameter passing
Windows API Analysis
Common Malicious API CallsAPI Call Identification in Disassembly
- Identify Windows API calls commonly used in malware
- Recognize API-level malware characteristics in assembly
- Understand dynamic API resolution techniques
3
Analyzing Malicious Documents and Scripts
18%
Malicious PDF Analysis
PDF Structure and ExploitationPDF JavaScript Deobfuscation
- Analyze malicious PDF files to identify exploitation techniques
- Extract and deobfuscate embedded JavaScript from PDFs
- Understand PDF-based attack vectors
Malicious Office Macros
VBA Macro AnalysisOffice Document Exploitation
- Analyze VBA macros in Microsoft Office documents
- Identify malicious Office document exploitation techniques
- Extract and deobfuscate embedded scripts
Malicious RTF Analysis
RTF Structure and Exploitation
- Examine malicious RTF files and identify exploitation techniques
- Extract and analyze embedded objects and shellcode
- Understand RTF-based attack vectors
Script-Based Malware
PowerShell Malware AnalysisJavaScript and VBScript Malware
- Analyze and deobfuscate PowerShell malware
- Examine JavaScript and VBScript-based threats
- Understand fileless malware techniques
4
In-Depth Malware Analysis and .NET Programs
15%
Packed and Obfuscated Malware
Recognizing Packed ExecutablesUnpacking TechniquesObfuscation Techniques
- Recognize packed Windows malware
- Apply unpacking techniques using debuggers
- Understand various obfuscation methods used in malware
.NET Malware Analysis
Identifying .NET Executables.NET Decompilation and AnalysisAdvanced .NET Techniques
- Analyze .NET programs to understand their capabilities
- Decompile and examine .NET assemblies
- Understand .NET-specific malware techniques
Fileless and Multi-Technology Malware
Fileless Malware TechniquesMulti-Stage Malware
- Analyze fileless malware and in-memory execution techniques
- Understand multi-technology and multi-stage malware
- Identify living-off-the-land attack techniques
5
Self-Defending Malware and Anti-Analysis Techniques
17%
Debugger Detection Techniques
Common Debugger Detection MethodsBypassing Debugger Detection
- Identify common debugger detection and data protection measures in malware
- Bypass debugger detection using patching and plugins
- Understand various anti-debugging techniques
Virtual Machine and Sandbox Detection
VM Detection TechniquesSandbox EvasionBypassing VM/Sandbox Detection
- Identify security tool detection mechanisms in malware
- Recognize VM and sandbox evasion techniques
- Bypass environment detection using various methods
Code Misdirection and Execution Flow Manipulation
Exception-Based Anti-AnalysisThread Local Storage (TLS) CallbacksProcess Hollowing and Injection
- Overcome misdirecting execution workflow as an anti-analysis technique
- Understand SEH, VEH, and TLS callback abuse
- Analyze process injection and hollowing techniques
Data Protection and Encryption
String Encryption and ObfuscationCode Encryption and Self-Modification
- Identify and bypass data protection measures in malware
- Analyze string and code encryption techniques
- Extract encrypted data using dynamic analysis
6
Advanced Malware Analysis Techniques
20%
Memory Forensics for Malware Analysis
Memory Acquisition and AnalysisMalware Artifact Extraction from Memory
- Analyze malware using memory forensics techniques
- Extract malicious artifacts from memory dumps
- Identify process injection and code manipulation in memory
Advanced Code Analysis
Complex Function AnalysisMalware Communication Protocols
- Perform advanced code-level analysis of malware functions
- Analyze malware command-and-control communications
- Reverse engineer custom network protocols
Malware Techniques and Capabilities
Common Malware PatternsCredential Theft and Data Exfiltration
- Identify common malware patterns including API calls, hooking, and injection
- Understand credential theft and data exfiltration techniques
- Analyze persistence and privilege escalation mechanisms
How do I earn this certification?
Passing GREM earns the GIAC Reverse Engineering Malware (GREM) certification. It sits in the Digital Forensics and Incident Response (DFIR) track.
Current Level Exams
Next Level Options
GSE - GIAC Security Expert Highest level GIAC certification demonstrating expert-level skills
Practice with Precision
The PlanetCert Simulator mirrors the real exam environment with authentic questions and timed pressure.
How to study for this exam?
The most effective way to prepare for GREM is by using the PlanetCert Simulator to practice questions and review detailed explanations.
Who should take this exam?
- 2+ years of experience in system/network administration or security
- Basic understanding of Windows operating system internals
- Familiarity with command-line tools
- Understanding of networking fundamentals
- Basic programming/scripting knowledge helpful but not required