Independent Norton Creek is an independent Reston, Virginia engineering consultancy founded by Devon Norton in 2017. We are not affiliated with Gen Digital Inc., NortonLifeLock or Norton antivirus, and we do not sell or support Norton-branded software.
Reston, Virginia · independent since 2017
Norton Creek Incident Triage Lab is a small engineering consultancy run by Devon Norton, CISSP, GCFA. We help practices, firms and contractors with 10 to 500 seats get ransomware out, get backups that restore, and get a network where one bad click stays one bad click.
Read this first We are not Norton antivirus and have nothing to do with Gen Digital or NortonLifeLock. Norton is Devon’s family name. We never call first, never show pop-ups, and never ask for gift cards.
CASE 26-114 Contained
Composite of real engagements, details changed.
What we do
We work as a short engagement or a retainer. Either way, you keep the runbook, the rules and the evidence. Nothing here needs a proprietary agent from us.
A baseline for Windows and macOS fleets of 10 to 500 seats that a two-person IT team can keep running.
Typical sprint 10 working days
We read your firewall export line by line and rebuild it around default-deny egress and named owners.
Rules removed, median 41%
Three copies, two media, one offsite, one immutable or offline, zero errors on a restore you timed.
Drill cadence every 90 days
Outpatient practices, dental groups and imaging centers where devices cannot be patched on your schedule.
Typical clinic 6 to 40 workstations
Contractor vans, delivery fleets and building sensors that report home over cellular and Wi-Fi.
Assessment 3 to 5 days
Interactive · runs in your browser, sends nothing
Most recovery plans quote the vendor’s restore speed. Real bare-metal recovery is identity first, then data, then verification, while someone reimages every endpoint the attacker touched. Put in your numbers and see which of those is your bottleneck.
Realistic bare-metal RTO
31 h
1.3 days of wall-clock recovery
NAS path 16 h / object-lock cloud path 67 h
Lateral-movement blast radius
19 of 45 endpoints reachable from patient zero (42%)
Elevated: lateral movement stops at the VLAN edge, but reused admin credentials still travel
DCs on their own VLAN, admin credentials still reused on workstations
This is a defensible plan. Prove it with a timed restore drill once a quarter, because the last 0 in 3-2-1-1-0 means zero errors on a restore you actually ran.
Containment design
Nearly every small-office ransomware case we have worked had the same shape: one phished user, one shared local admin password, and a flat network that let the attacker walk to the domain controller and the backup server in an afternoon. This is the map we redraw it into.
| Rule | Source | Destination | Port / proto | Action | Why |
|---|---|---|---|---|---|
| EG-01 | VLAN 20 workstations | Internet | TCP 80, 443 via proxy | Allow, logged | Browsing and SaaS, with DNS and TLS SNI recorded |
| EG-02 | VLAN 20 workstations | VLAN 20 workstations | TCP 135, 445, 3389, 5985-5986 | Deny | Kills PsExec, RDP hopping and WinRM between peers |
| EG-03 | VLAN 20 workstations | VLAN 10 DCs | TCP/UDP 53, 88, 389, 636, 445 (SYSVOL) | Allow | Logon and Group Policy only, nothing administrative |
| EG-04 | Any except resolver | Internet | TCP/UDP 53, TCP 853 | Deny | Forces DNS through the resolver you log |
| EG-05 | Any except mail relay | Internet | TCP 25 | Deny | An infected PC cannot become a spam cannon |
| EG-06 | VLAN 90 backup server | Object-lock bucket FQDN | TCP 443 | Allow | The one outbound path the vault needs |
| EG-07 | VLAN 40 IoMT / IoT | Internet | Any | Deny | Vendor updates go through an approved jump host |
| EG-99 | Any | Any | Any | Deny, logged | Default. Every exception above has an owner and a review date |
Detection baseline
Sysmon is free, it ships from Microsoft, and it records the events that matter for triage. The trick is a short, opinionated list of alerts, not ten thousand lines nobody reads. Here is ours.
| Event | Type | What we alert on | Triage |
|---|---|---|---|
| Event ID 1 | ProcessCreate | Office, PDF reader or browser spawning cmd.exe, powershell.exe, mshta.exe or wscript.exe; any vssadmin delete shadows, wbadmin delete catalog or bcdedit /set recoveryenabled no | Critical |
| Event ID 3 | NetworkConnect | Workstation-to-workstation connections on 445, 3389, 5985 and 5986; powershell.exe or rundll32.exe talking to the internet directly | High |
| Event ID 6 | DriverLoad | Any driver whose hash is on the Microsoft vulnerable driver blocklist, or that is unsigned, loaded outside a patch window | Critical |
| Event ID 8 | CreateRemoteThread | Remote thread created in lsass.exe, winlogon.exe or a browser by an unexpected source image | High |
| Event ID 10 | ProcessAccess | lsass.exe opened with GrantedAccess 0x1010 or 0x1410 by anything other than your EDR and Windows itself | Critical |
| Event ID 11 | FileCreate | Executables and scripts written to %AppData%, %ProgramData% or Startup; a burst of same-named ransom notes across shares | High |
| Event ID 13 | RegistryValueSet | New values under Run, RunOnce, Image File Execution Options and service ImagePath keys | Medium |
| Event ID 22 | DNSQuery | Lookups for remote-access tools you have not approved (AnyDesk, ScreenConnect, Atera) and first-seen domains from servers | Medium |
Field notes by Devon Norton, CISSP, GCFA
Field note · restore drills
The first question I ask on an incident call is not “do you have backups?” It is “when did you last restore one, and how long did it take?” About half the time, the honest answer is never. The backup job was green every night. It was also backing up a folder the line-of-business app stopped using two years ago.
Field note · local admin
Imaging every PC from one golden image is efficient, and it also gives every PC the same local administrator password. An attacker who dumps it once can log on to all of them. Windows LAPS is built into Windows now. Turning it on is the cheapest containment control there is.
Field note · remote access
More than once the attacker did not bring malware at all. They installed a legitimate remote-support tool, the same kind your MSP uses, and it sailed past antivirus. Keep a written list of approved remote tools and alert on DNS lookups for everything else. Event ID 22 makes that easy.
For an active incident, email [email protected] with your callback number and a one-line description. Do not send credentials or samples by email. For hardening, backup runbooks or clinic and fleet assessments, write to [email protected]. We are at 11951 Freedom Dr, Suite 420, Reston, VA 20190, and most of our clients are within an hour of the Dulles corridor.