GREM
GIAC Reverse Engineering Malware · GIAC
The GREM proves you can dissect malicious code: behavioural and static analysis, reverse engineering of Windows executables and .NET code, unpacking, bypassing anti-analysis techniques and analysing malicious documents. It is the best-known reference for malware analysts, sought after by CERTs, threat intelligence teams and security vendors. Its strength is a rare and very concrete skill; its limit is a narrow specialism and a high price with the SANS course.
- Exam
- 66 questions in 3 h, pass mark 73%. Open book (paper only), with hands-on CyberLive questions in a virtual machine. Taken remotely (ProctorU) or in a Pearson VUE centre.
- Exam price
- $999Same price with or without SANS training. The associated SANS course (FOR610) costs about US$8,780.
- Required experience
- No formal prerequisite. A good knowledge of Windows internals, networks and at least the basics of assembly is strongly advised.
- Validity and maintenance
- Valid 4 years. Renew with 36 CPE credits over the period and a US$499 fee (US$249 for each further renewal registered within two years of the first), or by passing the current exam again.
- Format
- Multiple choice and hands-on
- Recognition
- DoD 8140 approved
Who is it for?
Malware analysts, CERT and CSIRT members, threat intelligence analysts and forensic investigators who need to understand exactly what a sample does.
Domains covered
- Malware analysis fundamentals and core reverse-engineering concepts
- Behavioural and static analysis
- Assembly, functions, control flow and data structures
- Common malware patterns
- Unpacking and debugging packed malware
- Anti-analysis techniques and how to bypass them
- .NET malware and obfuscated code
- Malicious Office macros, PDF and RTF documents
Belinda’s take
Information checked on 2 October 2026 against the official site. Prices exclude tax and training, and may change.
The certification names mentioned are trademarks of their respective owners. KrakenShield is not affiliated with any certification body and does not reproduce any exam question.
