Malware is the instrument of almost every significant cyber attack. Understanding it at the binary level is one of the most powerful capabilities a security professional can develop. But malware reverse engineering is a craft skill that no exam can assess. XMRE is built for analysts who want to genuinely understand malware, not just identify it.
Across six instructor-led days, participants build capability from assembly language and file format understanding through static analysis using Ghidra and IDA Free, dynamic analysis in controlled sandbox environments, advanced obfuscation recognition and unpacking, network traffic analysis for malware communications, rootkit and kernel malware analysis, and structured threat intelligence extraction. Every session uses real malware samples from current threat actor campaigns in isolated, authorised lab environments.
On Day 6, participants receive an unknown malware sample. They conduct static and dynamic analysis, identify the malware family and capabilities, map techniques to MITRE ATT&CK, extract IOCs, and produce a professional threat intelligence report. A senior practitioner reviews analysis methodology and report quality. XMRE certificate and Practitioner Assessment Report issued together.
