An incident responder finds that an attacker used a compromised user account to create a scheduled task on multiple servers that runs a PowerShell script. The script downloads and executes a payload. Which lateral movement technique is the attacker using?

Scheduled task lateral movement

A malware analyst notices that a sample uses a custom packer and encrypts its strings. The sample also checks the system uptime to detect if it is running in a sandbox. Which defense evasion pattern is this?

Persistence through registry keys

Privilege escalation through token manipulation

Obfuscation and anti-sandbox techniques

A security team is investigating a compromised host that is using DNS tunneling for C2. The team wants to detect the C2 traffic without blocking DNS. Which detection approach is most effective?

Use a firewall to block all DNS traffic except to known DNS servers

Block all DNS queries to unknown domains

Disable DNS recursion on the internal DNS server

Monitor DNS query lengths and frequency for anomalies

GIAC Reverse Engineering Malware

Domain 3Objective 1

Common Malware Patterns GREM Practice Questions (Page 6)

Part of the Malware Patterns and Obfuscation domain, which makes up ~22% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 5–9 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

8concepts

Questions 26–30

26application · medium
An incident responder finds that an attacker used a compromised user account to create a scheduled task on multiple servers that runs a PowerShell script. The script downloads and executes a payload. Which lateral movement technique is the attacker using?
Select an answer first
27application · medium
A security analyst is reviewing network logs and sees a compromised host sending HTTP POST requests to a web server with parameters that contain base64-encoded data. The web server is not a known cloud service. Which data exfiltration pattern is this?
Select an answer first
28foundation · easy
Which of the following is the final stage in the typical malware attack lifecycle?
Select an answer first
29application · medium
A malware analyst notices that a sample uses a custom packer and encrypts its strings. The sample also checks the system uptime to detect if it is running in a sandbox. Which defense evasion pattern is this?
Select an answer first
30expert · hard
A security team is investigating a compromised host that is using DNS tunneling for C2. The team wants to detect the C2 traffic without blocking DNS. Which detection approach is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GREM

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GREM” is a trademark of its owner, used for identification only.

Common Malware Patterns GREM Practice Questions (Page 6)

Questions 26–30

An incident responder finds that an attacker used a compromised user account to create a scheduled task on multiple servers that runs a PowerShell script. The script downloads and executes a payload. Which lateral movement technique is the attacker using?

A security analyst is reviewing network logs and sees a compromised host sending HTTP POST requests to a web server with parameters that contain base64-encoded data. The web server is not a known cloud service. Which data exfiltration pattern is this?

Which of the following is the final stage in the typical malware attack lifecycle?

A malware analyst notices that a sample uses a custom packer and encrypts its strings. The sample also checks the system uptime to detect if it is running in a sandbox. Which defense evasion pattern is this?

A security team is investigating a compromised host that is using DNS tunneling for C2. The team wants to detect the C2 traffic without blocking DNS. Which detection approach is most effective?

Keep studying — Malware Patterns and Obfuscation