An incident responder discovers that an attacker used a stolen Kerberos ticket to authenticate to multiple servers and then used Windows Management Instrumentation (WMI) to execute a payload remotely. Which lateral movement pattern is this?

Pass-the-hash with remote scheduled task execution

Pass-the-ticket with remote WMI execution

Which of the following is an example of an anti-VM technique commonly used by malware?

Querying the MAC address for a known VMware prefix

Encrypting strings with a custom algorithm

Creating a mutex to prevent multiple instances

Checking for the presence of a debugger

A malware sample is observed to first drop a file to disk, then create a registry Run key, then begin beaconing to an external IP. Which malware lifecycle stages are these actions in order?

Persistence, installation, exfiltration

Delivery, exploitation, installation

Installation, persistence, command and control

Command and control, persistence, impact

GIAC Reverse Engineering Malware

Domain 3Objective 1

Common Malware Patterns GREM Practice Questions (Page 5)

Part of the Malware Patterns and Obfuscation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 21–25

21application · medium
An incident responder discovers that an attacker used a stolen Kerberos ticket to authenticate to multiple servers and then used Windows Management Instrumentation (WMI) to execute a payload remotely. Which lateral movement pattern is this?
Select an answer first
22foundation · easy
A malware sample collects sensitive files and sends them to a remote server using an HTTP POST request. Which data exfiltration pattern does this represent?
Select an answer first
23application · medium
A security analyst sees a compromised host sending emails with attachments to an external address. The attachments contain compressed data that appears to be stolen files. Which data exfiltration pattern is this?
Select an answer first
24foundation · easy
Which of the following is an example of an anti-VM technique commonly used by malware?
Select an answer first
25application · medium
A malware sample is observed to first drop a file to disk, then create a registry Run key, then begin beaconing to an external IP. Which malware lifecycle stages are these actions in order?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Common Malware Patterns GREM Practice Questions (Page 5)

Questions 21–25

An incident responder discovers that an attacker used a stolen Kerberos ticket to authenticate to multiple servers and then used Windows Management Instrumentation (WMI) to execute a payload remotely. Which lateral movement pattern is this?

A malware sample collects sensitive files and sends them to a remote server using an HTTP POST request. Which data exfiltration pattern does this represent?

A security analyst sees a compromised host sending emails with attachments to an external address. The attachments contain compressed data that appears to be stolen files. Which data exfiltration pattern is this?

Which of the following is an example of an anti-VM technique commonly used by malware?

A malware sample is observed to first drop a file to disk, then create a registry Run key, then begin beaconing to an external IP. Which malware lifecycle stages are these actions in order?

Keep studying — Malware Patterns and Obfuscation