Reverse-Engineering Malware

This course prepares you for the GIAC GREM exam objectives. iSecRadar is not affiliated with, sponsored by or endorsed by GIAC or the SANS Institute. GREM is a certification of GIAC, and exam registration is completed directly with GIAC.

About the Reverse-Engineering Malware course

Reverse-Engineering Malware teaches you to understand what malicious software does and how it works. You start with behavioral analysis in an isolated lab, then move to code analysis with disassemblers and debuggers to uncover capabilities, configuration and indicators of compromise.

The course follows the GIAC Reverse Engineering Malware (GREM) exam objectives. All samples are handled only inside isolated lab environments with strict safety procedures.

Who this course is for

• Incident responders and forensic analysts
• Threat intelligence analysts
• Detection engineers who write signatures and rules
• Security researchers

Prerequisites

• Incident response or forensic experience
• Comfort with Windows internals and the command line
• Basic programming knowledge; assembly is taught in the course

What you'll learn

• Set up a safe, isolated malware analysis lab
• Perform behavioral analysis to observe malware actions
• Analyze code with disassemblers and debuggers
• Prepare for the GREM exam objectives

Syllabus

1. Malware analysis lab setup and safety
2. Behavioral and static analysis fundamentals
3. x86/x64 assembly for analysts
4. Disassembly and debugging techniques
5. Packed, obfuscated and malicious document analysis
6. Reporting, indicators and exam objectives review

Hands-on labs and exercises

• Build an isolated malware analysis environment
• Observe malware behavior on the host and network
• Unpack and deobfuscate samples
• Analyze malicious documents and scripts
• Extract indicators and write an analysis report

Where this course takes you

• Malware analyst and reverse engineer roles
• Threat intelligence and detection engineering work
• Strengthens incident response and forensic investigations

Included

• Live sessions with session recordings
• Guided lab environment
• Certificate of completion
• Community and instructor Q&A