A penetration tester finds that a service running with SYSTEM privileges has a weak file permission that allows any user to replace its executable. Which privilege escalation pattern does this represent?

Unquoted service path or weak service binary permissions

A malware analyst is triaging a new sample and observes that it creates a mutex named 'Global\MALWARE_RUNNING' to ensure only one instance executes, then drops a DLL into the Windows directory and schedules a task to run it. Which two structural/behavioral pattern categories best describe these observations?

Command and control and data exfiltration

Persistence and single-instance control

Privilege escalation and credential dumping

A malware sample uses a technique where it checks the amount of RAM and the presence of a specific BIOS string before executing its payload. If the checks fail, the sample exits. Which defense evasion technique is the sample using?

C2 communication via DNS tunneling

GIAC Reverse Engineering Malware

Domain 3Objective 1

Common Malware Patterns GREM Practice Questions (Page 1)

Part of the Malware Patterns and Obfuscation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 1–5

1foundation · easy
Which of the following is a common lateral movement technique that involves creating a task on a remote system to execute a payload?
Select an answer first
2application · medium
A network analyst observes a compromised host sending small DNS queries at regular intervals to a domain that is not part of the corporate namespace. The queries contain encoded data in the subdomain labels. Which C2 pattern is most likely in use?
Select an answer first
3application · medium
A penetration tester finds that a service running with SYSTEM privileges has a weak file permission that allows any user to replace its executable. Which privilege escalation pattern does this represent?
Select an answer first
4foundation · easy
A malware analyst is triaging a new sample and observes that it creates a mutex named 'Global\MALWARE_RUNNING' to ensure only one instance executes, then drops a DLL into the Windows directory and schedules a task to run it. Which two structural/behavioral pattern categories best describe these observations?
Select an answer first
5application · medium
A malware sample uses a technique where it checks the amount of RAM and the presence of a specific BIOS string before executing its payload. If the checks fail, the sample exits. Which defense evasion technique is the sample using?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Common Malware Patterns GREM Practice Questions (Page 1)

Questions 1–5

Which of the following is a common lateral movement technique that involves creating a task on a remote system to execute a payload?

A network analyst observes a compromised host sending small DNS queries at regular intervals to a domain that is not part of the corporate namespace. The queries contain encoded data in the subdomain labels. Which C2 pattern is most likely in use?

A penetration tester finds that a service running with SYSTEM privileges has a weak file permission that allows any user to replace its executable. Which privilege escalation pattern does this represent?

A malware sample uses a technique where it checks the amount of RAM and the presence of a specific BIOS string before executing its payload. If the checks fail, the sample exits. Which defense evasion technique is the sample using?

Keep studying — Malware Patterns and Obfuscation