terminal

$ whoami

Võ Trọng Đức

$ cat role.txt

Security Engineer | Automation Specialist

$ echo $STATUS

Available for opportunities

Open to Work

Võ Trọng Đức

Security Engineer | Automation Specialist

Building secure systems and automating complex workflows. Passionate about threat detection, algo-trading, and CTF challenges.

View Projects CTF Write-ups

About Me

Security-focused engineer with a passion for building automated solutions and tackling complex cybersecurity challenges. Currently pursuing Information Assurance at FPT University while working on real-world security projects.

Experienced in SOC operations, network intrusion detection, and developing automation tools. Active CTF competitor with expertise in forensics, reverse engineering, and web exploitation.

Ho Chi Minh City FPT University votrongduc0811@gmail.com

Projects

10+

CTF Write-ups

3.2

GPA

Certifications

Skills

Security

SOC Operations90%

Network Intrusion Detection85%

Penetration Testing75%

MITRE ATT&CK80%

Development & Tools

Python90%

ELK Stack85%

Wireshark / IDA Pro80%

Selenium / Web Scraping85%

Engineering Projects

Security

Hybrid NIDS

Developed a hybrid NIDS integrating Suricata signature-based detection with ML models (Random Forest, XGBoost) trained on CICIDS2017 dataset. Features real-time alerting via Telegram API with 95% detection accuracy.

ELK Stack Machine Learning MITRE ATT&CK Python

99,46%

Detection Accuracy

< 2s

Response Time

Automation

Prospire Algo-Trading

Algorithm-driven cryptocurrency trading bot with real-time market tracking and automated trade execution.

Python APIs

$100k

/week volume

Financial Telegram Bot & Python Scrapers

Telegram bot delivering real-time financial statements for 1600+ Vietnamese companies. Integrates web scraping tools with async processing for high-throughput data delivery.

Telegram API Producer-Consumer Selenium BeautifulSoup

Malware Research

Snake Game Keylogger

Proof-of-concept malware analysis lab simulating a full attack lifecycle: phishing delivery, credential harvesting, persistence, and C2 exfiltration via Telegram.

MITRE ATT&CK Python Credential Theft C2

ATT&CK Techniques

Full

Kill Chain

CTF Vault

Reverse

EzLogic

Logic gate reversing challenge from 0CTF 2024

Forensic

Easy Forensics

Registry extraction and password cracking

Forensic

Known Unknowns

Wireshark DNS traffic analysis

Forensic

tet-riffic!

Audio steganography challenge

Forensic

St3g0

PNG LSB steganography

Forensic

Verify

File hash verification challenge

Forensic

m00nwalk

SSTV audio decoding

Web

Gimme Your Point

Race condition exploitation

Forensic

FOR2 - ICMP Backdoor

ICMP packet analysis & backdoor detection

Reverse

RE02 - Excel Macro

VBA macro analysis and decryption

Experience

Prospire

May 2023 - Present

Co-Founder & Founding Engineer

Building automated crypto trading systems and developing high-frequency trading algorithms with real-time market data processing.

Viettel IDC

Jul - Oct 2025

Security Engineer Intern (SOC)

SOC operations, threat hunting, and developing automation tools for security monitoring using ELK Stack.

HPT Vietnam Corporation

Dec 2023 - Apr 2024

Security Training Program

Intensive security training covering penetration testing, incident response, and security analysis methodologies.

Certifications

Partner Cloud Security

Cloud Security

Cisco

CyberOps Associate

Security Operations

Cisco

On-Job Training

Security Training

HPT Vietnam Corporation

Introduction to Networks

CCNAv7

Cisco

Switching, Routing, Wireless

CCNA

Cisco

Honorable Student

Fall 2023

FPT University

Honorable Student

Fall 2024

FPT University

Honorable Student

Spring 2025

FPT University

Technique ID	Name	Description
`T1027`	Obfuscated Files or Information	Custom logic encoding
`T1140`	Deobfuscate/Decode	Position-based decryption

Technique ID	Name	Description
`T1547.001`	Registry Run Keys	Persistence via startup registry
`T1027`	Obfuscated Files	Base64 encoded payload
`T1059.001`	PowerShell	Fileless execution

Technique ID	Name	Description
`T1001.002`	Data Obfuscation: Steganography	Data hidden in audio frequency
`T1027`	Obfuscated Files	Visual encoding in spectrograms

Technique ID	Name	Description
`T1056.001`	Keylogging	USB HID keystroke capture
`T1001.002`	Steganography	QR code hidden in game
`T1027`	Obfuscated Files	Data encoded in Tetris patterns

Technique ID	Name	Description
`T1001.002`	Steganography	LSB encoding in images
`T1027`	Obfuscated Files	Hidden data in image bits

Technique ID	Name	Description
`T1027`	Obfuscated Files	Flag hidden among decoys
`T1140`	Deobfuscate/Decode	Hash-based file identification

Technique ID	Name	Description
`T1001.002`	Steganography	Data encoded in audio
`T1027`	Obfuscated Files	SSTV signal encoding

Technique ID	Name	Description
`T1190`	Exploit Public-Facing Application	SharePoint CVE-2025-49704
`T1059.001`	PowerShell	Payload download & execution
`T1555.003`	Credentials from Web Browsers	Chrome Login Data theft
`T1560.001`	Archive Collected Data	Password-protected ZIP
`T1041`	Exfiltration Over C2 Channel	HTTP POST upload

Technique ID	Name	Description
`T1095`	Non-Application Layer Protocol	ICMP for C2 communication
`T1048.003`	Exfiltration Over Alternative Protocol	Data hidden in ICMP packets
`T1041`	Exfiltration Over C2 Channel	Flag file extraction

Technique ID	Name	Description
`T1059.005`	Visual Basic	XLM macro execution
`T1204.002`	Malicious File	User opens infected Excel
`T1027`	Obfuscated Files	String reversal/splitting
`T1140`	Deobfuscate	Runtime string assembly

Tactic	Technique	Implementation
Initial Access	`T1566.001` Phishing: Spear-phishing Attachment	Malicious game distributed via email
Execution	`T1204.002` User Execution: Malicious File	Victim launches trojanized Snake game
Persistence	`T1547.001` Boot or Logon Autostart: Registry Run Keys	Script added to Windows Startup folder
Credential Access	`T1056.001` Input Capture: Keylogging	pynput library captures all keystrokes
Credential Access	`T1555.003` Credentials from Password Stores: Browsers	Chrome SQLite database decryption via AES
Exfiltration	`T1567.002` Exfiltration Over Web Service	Data sent to attacker via Telegram Bot API

Area	Task	Technical Detail
Data Preprocessing	CICIDS2017 Dataset	2.2M benign + 557k attack samples, balanced & cleaned
Feature Engineering	78 → 9 Features	Removed constant/correlated features, mapped to Suricata logs
Model Training	Ensemble ML	DT (20%) + RF (30%) + XGBoost (50%) weighted voting
Integration	Real-time Pipeline	Suricata eve.json → Feature Extraction → ML Inference

Model	Accuracy	Weight	Role
Decision Tree	99.19%	20%	Fast baseline detection
Random Forest	99.38%	30%	Balanced precision/recall
XGBoost	99.46%	50%	Primary detector, tuned via GridSearchCV

Attack Type	Detection Logic	Threshold
Port Scan	`ports_in_window / ips_in_window > 10`	score > 0.7
Host Scan	`ips_in_window / ports_in_window > 5`	score > 0.7
Brute Force	`auth_failures to same service > 3`	score > 0.7
Volume Anomaly	`bytes/sec > 1MB OR packets/sec > 1000`	score > 0.7

Võ Trọng Đức

About Me

Skills

Security

Development & Tools

Engineering Projects

Hybrid NIDS

Prospire Algo-Trading

Financial Telegram Bot & Python Scrapers

Snake Game Keylogger

CTF Vault

EzLogic

Easy Forensics

Known Unknowns

tet-riffic!

St3g0

Verify

m00nwalk

Gimme Your Point

FOR2 - ICMP Backdoor

RE02 - Excel Macro

Experience

Certifications

Partner Cloud Security

CyberOps Associate

On-Job Training

Introduction to Networks

Switching, Routing, Wireless

Honorable Student

Honorable Student

Honorable Student

Title

📋 Executive Summary

🎯 MITRE ATT&CK Mapping

🔍 Technical Analysis

💡 The Breakthrough

🛡️ Detection Strategy (Blue Team)

📋 Executive Summary

🎯 MITRE ATT&CK Mapping

🔍 Technical Analysis

💡 The Breakthrough

🛡️ Detection Strategy (Blue Team)

📋 Executive Summary

🎯 MITRE ATT&CK Mapping

🔍 Technical Analysis

💡 The Breakthrough

🛡️ Detection Strategy (Blue Team)

📋 Executive Summary

🎯 MITRE ATT&CK Mapping

🔍 Technical Analysis

💡 The Breakthrough

🛡️ Detection Strategy (Blue Team)

📋 Executive Summary

🎯 MITRE ATT&CK Mapping

🔍 Technical Analysis

💡 The Breakthrough

🛡️ Detection Strategy (Blue Team)

📋 Executive Summary

🎯 MITRE ATT&CK Mapping

🔍 Technical Analysis

💡 The Breakthrough

🛡️ Detection Strategy (Blue Team)

📋 Executive Summary

🎯 MITRE ATT&CK Mapping

🔍 Technical Analysis

💡 The Breakthrough

🛡️ Detection Strategy (Blue Team)

📋 Executive Summary

🎯 MITRE ATT&CK Mapping

🔍 Phase 1: Initial PCAP Analysis

🔍 Phase 2: CVE Research - ToolShell Vulnerability

🔍 Phase 3: Payload Decoding

🔍 Phase 4: Malware Analysis

💡 Phase 5: The Breakthrough - IDA Reverse Engineering

🛡️ Detection Strategy (Blue Team)

📋 Executive Summary

🎯 MITRE ATT&CK Mapping

🔍 Technical Analysis

💡 The Breakthrough

🛡️ Detection Strategy (Blue Team)