GREM (GIAC Reverse Engineering Malware)
GREM covers analyzing and reverse-engineering malware that targets common platforms such as Microsoft Windows and web browsers, in the context of forensic investigations, incident response, and Windows system administration. Topics include behavioral and code analysis, Windows assembly concepts, self-defending malware, and malicious documents, .NET programs, and protected executables. The audience includes system and network administrators, security consultants, forensic investigators, and people who have dealt with malware incidents. GIAC pairs it with SANS FOR610.
Updated
Exam Details
- Issuer
- GIAC
- Level
- Advanced
- Exam type
- Multiple choice and performance-based
- Questions
- 66
- Duration
- 3 hours
- Passing score
- 73%
- Exam fee
- $999
- Validity
- 4 years
- Tracks
- Forensics and Incident Response
Open-book, web-based exam, proctored remotely through ProctorU or onsite at a Pearson VUE test center. It includes CyberLive hands-on questions run in virtual machines.
Price of one certification attempt with 120 days of access. A retake after a failed attempt is $899, a 45-day extension is $479, and a practice test is $399. Prices exclude sales tax.
Requirements and Renewal
Prerequisites
None. GIAC sets no prerequisites for any certification attempt but recommends a training course first.
Renewal
Earn 36 CPEs during the four-year cycle (or retake the exam) and pay the $499 maintenance fee. Additional renewals within two years of a full-price renewal cost $249.
Exam Domains
15 domains| Domain |
|---|
| Analyzing Malicious Office Macros |
| Analyzing Malicious PDFs |
| Analyzing Malicious RTF Files |
| Analyzing Obfuscated Malware |
| Behavioral Analysis Fundamentals |
| Common Malware Patterns |
| Core Reverse Engineering Concepts |
| Examining .NET Malware |
| Identifying and Bypassing Anti-Analysis Techniques |
| Malware Analysis Fundamentals |
| Malware Flow Control and Structures |
| Overcoming Misdirection Techniques |
| Reversing Functions in Assembly |
| Static Analysis Fundamentals |
| Unpacking and Debugging Packed Malware |
DoD 8140 Work Roles
1 work rolesThe DoD 8140 Qualification Matrix V2.1 lists GREM as a foundational qualification option for these DoD Cyber Workforce Framework work roles, up to the proficiency level shown. Lower levels of the same work role are also covered.
Frequently Asked Questions
What does GREM stand for?→
GREM stands for GIAC Reverse Engineering Malware. GIAC itself was previously named Global Information Assurance Certification.
How much does the GREM exam cost?→
One GREM certification attempt costs $999. A retake is $899 and a practice test is $399.
How many questions are on the GREM exam?→
The exam has 66 questions and a 3-hour time limit, with a passing score of 73% for versions released on or after August 27, 2022.
What happens if you fail a GIAC exam?→
Candidates can buy a retake within 30 days after the attempt deadline and must wait 30 days before sitting again. After three failed attempts the attempt ends, and a new one cannot be bought for one year.
Sources
- GIAC: GIAC Reverse Engineering Malware (GREM)
- GIAC Knowledge Base: Proctor Program Overview (open book guidelines)
- GIAC: How to Renew
- GIAC Certification Pricing and Fees
- GIAC Knowledge Base: Renewal
- GIAC Knowledge Base: Retakes and Extensions
- GIAC: DoD 8140 Directive
- GIAC Company Info
- GIAC Proctoring
- GIAC CyberLive
Exam details are checked against official GIAC pages. Fees, exam versions, and renewal rules change; confirm with GIAC before registering. GREM is a trademark of its owner. This site is not affiliated with or endorsed by GIAC.