National Cheng Kung University

National Sun Yat-Sen University

Threat Researcher at Trend Micro

Collaborating closely with product managers and multiple product/sensor teams, I actively contribute to new initiatives and drive continuous improvements.

Trend Micro

Architect

• Led an international team of 10+ members as the Trend Micro XDR threat expert, overseeing activities such as threat hunting, red team attack simulations, blue team defensive solutions, and pattern operations.
• Collaborated with team members to publish insightful threat hunting results as blog posts, with two blogs already published.
• Worked closely with various Trend Micro products/sensors to enhance XDR telemetry coverage and minimize noise.
• Collaborated with multiple Trend Micro XDR teams to enhance UI logic and visualization, ensuring optimal user experience.
• Collaborated with data scientists on AI-based detection, defining alert quality metrics, and designing a robust quality monitoring platform.
• Served as the Trend Micro blue team lead for the 2020 MITRE ATT&CK Evaluation.
• Led Trend Micro remote support blue team for the 2019 MITRE ATT&CK Evaluation.
• For LinkedIn contact, please include #isawthetag in the message.

Threat Expert Lead at Trend Micro XDR

• Published a total of 5 insightful blogs on various topics within the field of threat research, demonstrating a strong commitment to sharing knowledge and insights.
• Delivered engaging presentations at numerous international and local conferences, including esteemed events such as CODE BLUE and Virus Bulletin.
• Presented at notable local security events, including LINE/GrayLab - TW Becks Security Meetup, further contributing to the local security community.
• Conducted thorough threat hunting utilizing internal and external big data intelligence platforms as well as open-source intelligence (OSINT).
• Leveraged industry-leading tools like IDA Pro, OllyDbg, Cuckoo, and Wireshark to analyze diverse malware samples, such as malicious PDFs, Office Documents, and PE files.
• Collaborated closely with the infrastructure team to design and enhance the internal system dedicated to APT investigation and APT group correlation, ensuring efficient and effective threat analysis processes.
• Developed Python scripts to automate the malware analysis workflow, streamlining and expediting the analysis process.
• Evaluated EDR/MDR products and provided valuable improvement suggestions through purple teaming exercises, promoting the enhancement of defensive capabilities.
• Analyzed malware and other malicious indicators found in cases handled by IR teams or provided by tech support, contributing to incident response efforts and overall security incident management.

Threat Researcher

• Conducted in-depth analysis of nation-state espionage campaigns, producing comprehensive reports that provided valuable insights and actionable intelligence.
• Leveraged expertise in developing automatic tools, such as malware sandboxes like Cuckoo, to detect and analyze web threats with efficiency and accuracy. These tools played a crucial role in enhancing threat detection capabilities and facilitating proactive defense measures.

Taiwan National Computer Emergency Response Team

APT Malware Analyst

Research area:
 • Security testbed based on Emulab with Prof. Douglas Taylor 
 • Privacy protection with Prof. Dawn Xiaodong Song.

Ming-Yen H.