A security team wants to create a YARA rule to detect a specific malicious RTF campaign. The campaign uses a distinctive header followed by an obfuscated string that decodes to a known C2 domain. The obfuscation uses a simple XOR with a single-byte key. Which YARA rule structure best detects this campaign while minimizing false positives?

Match the decoded C2 domain string in the raw file.

Use a rule that matches the XOR key byte followed by the encoded domain.

Match only the RTF header '{\rtf1' to catch all RTF files.

Match the literal RTF header '{\rtf1' and the XOR-encoded C2 domain bytes in the raw file.

After analyzing a malicious RTF file, an analyst must document the findings for the incident response team. Which information is most critical to include in the report?

The file's creation date and author metadata.

The name of the user who reported the file.

The exact RTF control words used, the embedded object's hash, and the macro's behavior.

The file's color scheme and font choices.

A security team is investigating a series of RTF files that exploit a vulnerability in an older version of Microsoft Word. The team has a YARA rule that detects the exploit, but it is missing some variants that use a different obfuscation of the payload. The team needs to update the rule to catch all variants. Which approach is most effective?

Broaden the YARA rule to match any RTF file with the '\object' control word.

Remove the YARA rule and rely on manual analysis of each file.

Use a YARA rule that matches the file's MD5 hash.

Analyze the variants to identify a common invariant, such as the same embedded object CLSID or a consistent exploit trigger, and add that to the YARA rule.

What is the primary purpose of analyzing macros extracted from a malicious RTF file?

To check the document's spelling and grammar.

To identify the author of the document.

To convert the macro into a PDF for easier reading.

To determine the behavior and intent of the macro, such as downloading a payload or executing commands.

GIAC Reverse Engineering Malware

Domain 4Objective 3

Analyzing Malicious RTF Files GREM Practice Questions (Page 7)

Part of the Document and File Analysis domain, which makes up ~23% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~16–28 in this domain), expect 5–9 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

10concepts

Questions 31–35

31foundation · easy
Which of the following is a common dynamic analysis tool used to observe the behavior of a malicious RTF file?
Select an answer first
32application · medium
A security team wants to create a YARA rule to detect a specific malicious RTF campaign. The campaign uses a distinctive header followed by an obfuscated string that decodes to a known C2 domain. The obfuscation uses a simple XOR with a single-byte key. Which YARA rule structure best detects this campaign while minimizing false positives?
Select an answer first
33application · medium
After analyzing a malicious RTF file, an analyst must document the findings for the incident response team. Which information is most critical to include in the report?
Select an answer first
34expert · hard
A security team is investigating a series of RTF files that exploit a vulnerability in an older version of Microsoft Word. The team has a YARA rule that detects the exploit, but it is missing some variants that use a different obfuscation of the payload. The team needs to update the rule to catch all variants. Which approach is most effective?
Select an answer first
35foundation · easy
What is the primary purpose of analyzing macros extracted from a malicious RTF file?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Analyzing Malicious RTF Files GREM Practice Questions (Page 7)

Questions 31–35

Which of the following is a common dynamic analysis tool used to observe the behavior of a malicious RTF file?

After analyzing a malicious RTF file, an analyst must document the findings for the incident response team. Which information is most critical to include in the report?

What is the primary purpose of analyzing macros extracted from a malicious RTF file?

Keep studying — Document and File Analysis