Skip to content

Independent Norton Creek is an independent Reston, Virginia engineering consultancy founded by Devon Norton in 2017. We are not affiliated with Gen Digital Inc., NortonLifeLock or Norton antivirus, and we do not sell or support Norton-branded software.

Norton CreekIncident Triage Lab

Reston, Virginia · independent since 2017

Incident triage and endpoint hardening for offices that cannot afford a lost week.

Norton Creek Incident Triage Lab is a small engineering consultancy run by Devon Norton, CISSP, GCFA. We help practices, firms and contractors with 10 to 500 seats get ransomware out, get backups that restore, and get a network where one bad click stays one bad click.

Read this first We are not Norton antivirus and have nothing to do with Gen Digital or NortonLifeLock. Norton is Devon’s family name. We never call first, never show pop-ups, and never ask for gift cards.

Report an active incidentEstimate your recovery time

CASE 26-114 Contained

Client
Four-dentist practice, 31 endpoints
Initial access
Phished Microsoft 365 session, then VPN logon without MFA
Dwell time
9 days
Lateral movement
PsExec over SMB 445 with a shared local admin
Backups
NAS snapshots deleted; object-lock copy intact
RTO achieved
31 h to first patient booked

Composite of real engagements, details changed.

What we do

Five runbooks, each one written to be handed to your own IT person

We work as a short engagement or a retainer. Either way, you keep the runbook, the rules and the evidence. Nothing here needs a proprietary agent from us.

RB-01Endpoint

SMB endpoint hardening

A baseline for Windows and macOS fleets of 10 to 500 seats that a two-person IT team can keep running.

  1. Windows LAPS on every machine, so no two share a local admin password
  2. Attack Surface Reduction rules in block mode after a two-week audit
  3. BitLocker with TPM and PIN on laptops; FileVault with escrowed keys on Macs
  4. Sysmon with the baseline below, shipped to a log store you actually read

Typical sprint 10 working days

RB-02Firewall

Zero-trust firewall baseline triage

We read your firewall export line by line and rebuild it around default-deny egress and named owners.

  1. Inventory every any-any rule and who asked for it
  2. Split users, servers, tier-0, IoT and backup into VLANs
  3. Block east-west admin ports between workstations
  4. Log denies for 30 days before tightening further

Rules removed, median 41%

RB-03Recovery

3-2-1-1-0 immutable backup runbooks

Three copies, two media, one offsite, one immutable or offline, zero errors on a restore you timed.

  1. Backup server off the domain, console behind its own MFA
  2. Object-lock retention set longer than typical attacker dwell time
  3. Restore order written down: identity, line-of-business, files, archives
  4. Quarterly timed restore drill with the clock running

Drill cadence every 90 days

RB-04Clinical

Medical and dental HIPAA workstation isolation

Outpatient practices, dental groups and imaging centers where devices cannot be patched on your schedule.

  1. IoMT and imaging modalities on their own VLAN with no internet
  2. FIDO2 security keys for EHR and practice-management logins
  3. Automatic logoff and badge tap-out on shared operatory PCs
  4. Audit controls mapped to 45 CFR 164.312

Typical clinic 6 to 40 workstations

RB-05Telemetry

CAN-bus and IoT telemetry security

Contractor vans, delivery fleets and building sensors that report home over cellular and Wi-Fi.

  1. Inventory every OBD-II dongle, gateway and cloud token
  2. Prefer read-only telematics; no CAN transmit from aftermarket devices
  3. Signed firmware and private APNs for fleet hardware
  4. Telemetry ingest isolated from dispatch and billing systems

Assessment 3 to 5 days

Interactive · runs in your browser, sends nothing

3-2-1-1-0 immutable backup RTO and ransomware blast-radius calculator

Most recovery plans quote the vendor’s restore speed. Real bare-metal recovery is identity first, then data, then verification, while someone reimages every endpoint the attacker touched. Put in your numbers and see which of those is your bottleneck.

Data and copies
TB

Everything you would need back to operate, after dedupe.

Gbps

Link speed between the NAS and the restore targets.

Mbps

Your internet download speed you can dedicate to the restore.

Environment
hosts

Workstations, laptops and servers joined to the domain.

people

People who can reimage machines during the incident.

Realistic bare-metal RTO

31 h

1.3 days of wall-clock recovery

Identity (AD) recovery
12 h
Data rehydration from the local NAS
16 h
Restore verification (the final 0)
2.5 h
Endpoint reimage, in parallel
3.8 h

NAS path 16 h / object-lock cloud path 67 h

Lateral-movement blast radius

19 of 45 endpoints reachable from patient zero (42%)

Elevated: lateral movement stops at the VLAN edge, but reused admin credentials still travel

DCs on their own VLAN, admin credentials still reused on workstations

This is a defensible plan. Prove it with a timed restore drill once a quarter, because the last 0 in 3-2-1-1-0 means zero errors on a restore you actually ran.

Assumptions behind the numbers
  • 1 TB is 8 × 1012 bits. Local NAS restores run at 65% of link speed once you account for rehydration and small files; object-lock pulls run at 80% of the bandwidth you give them.
  • Active Directory recovery takes 4 hours with a tier-0 design and an offline system-state backup, 12 hours with DCs on their own VLAN, and 36 hours for a forest recovery on a flat network, from our own engagements.
  • Verification is 15% of data time with a one-hour floor: hash checks, test logons and a line-of-business smoke test.
  • One responder reimages about six endpoints an hour with a working image. Reimaging runs alongside the data restore once identity is back.
  • Blast radius is the share of endpoints reachable with the credentials and ports typically available in each design: 88%, 42% and 12%. Treat it as a planning figure, not a forecast.

Containment design

One workstation lost should mean one workstation lost

Nearly every small-office ransomware case we have worked had the same shape: one phished user, one shared local admin password, and a flat network that let the attacker walk to the domain controller and the backup server in an afternoon. This is the map we redraw it into.

Lateral-movement containment map for a small office network A compromised workstation on VLAN 20 is blocked from reaching other workstations, the clinical and IoT VLAN, and administrative ports on the tier-0 domain controllers. Only Kerberos, LDAPS and DNS reach the controllers. The backup vault has no domain trust and pushes copies outward over HTTPS to an object-lock bucket. Internet object-lock bucket WORM · 30 days Edge firewall default-deny egress 443 VLAN 20 · workstations patient zero 445/3389/5985 east-west: denied Windows LAPS: no shared local admin VLAN 10 · tier-0 DC01 DC02 separate admin accounts offline system-state backup 88/636/53 RDP / WinRM VLAN 40 · IoMT / imaging pump CBCT PACS gw no internet · vendor jump host only denied VLAN 90 · backup vault no domain trust · MFA console immutable local snapshots pull-only from protected hosts no trust HTTPS 443 to the bucket FQDN only
Cyan flows are allowed and logged. Amber crosses are denied at the switch or host firewall. The question this map answers is simple: when one workstation is lost, what else is reachable from it?
Baseline egress and east-west rules for a 10 to 500 seat office
RuleSourceDestinationPort / protoActionWhy
EG-01VLAN 20 workstationsInternetTCP 80, 443 via proxyAllow, loggedBrowsing and SaaS, with DNS and TLS SNI recorded
EG-02VLAN 20 workstationsVLAN 20 workstationsTCP 135, 445, 3389, 5985-5986DenyKills PsExec, RDP hopping and WinRM between peers
EG-03VLAN 20 workstationsVLAN 10 DCsTCP/UDP 53, 88, 389, 636, 445 (SYSVOL)AllowLogon and Group Policy only, nothing administrative
EG-04Any except resolverInternetTCP/UDP 53, TCP 853DenyForces DNS through the resolver you log
EG-05Any except mail relayInternetTCP 25DenyAn infected PC cannot become a spam cannon
EG-06VLAN 90 backup serverObject-lock bucket FQDNTCP 443AllowThe one outbound path the vault needs
EG-07VLAN 40 IoMT / IoTInternetAnyDenyVendor updates go through an approved jump host
EG-99AnyAnyAnyDeny, loggedDefault. Every exception above has an owner and a review date

Detection baseline

The Sysmon rules that catch the attacks we actually see

Sysmon is free, it ships from Microsoft, and it records the events that matter for triage. The trick is a short, opinionated list of alerts, not ten thousand lines nobody reads. Here is ours.

Sysmon baseline we ship to every Windows endpoint on day one
EventTypeWhat we alert onTriage
Event ID 1ProcessCreateOffice, PDF reader or browser spawning cmd.exe, powershell.exe, mshta.exe or wscript.exe; any vssadmin delete shadows, wbadmin delete catalog or bcdedit /set recoveryenabled noCritical
Event ID 3NetworkConnectWorkstation-to-workstation connections on 445, 3389, 5985 and 5986; powershell.exe or rundll32.exe talking to the internet directlyHigh
Event ID 6DriverLoadAny driver whose hash is on the Microsoft vulnerable driver blocklist, or that is unsigned, loaded outside a patch windowCritical
Event ID 8CreateRemoteThreadRemote thread created in lsass.exe, winlogon.exe or a browser by an unexpected source imageHigh
Event ID 10ProcessAccesslsass.exe opened with GrantedAccess 0x1010 or 0x1410 by anything other than your EDR and Windows itselfCritical
Event ID 11FileCreateExecutables and scripts written to %AppData%, %ProgramData% or Startup; a burst of same-named ransom notes across sharesHigh
Event ID 13RegistryValueSetNew values under Run, RunOnce, Image File Execution Options and service ImagePath keysMedium
Event ID 22DNSQueryLookups for remote-access tools you have not approved (AnyDesk, ScreenConnect, Atera) and first-seen domains from serversMedium

Field notes by Devon Norton, CISSP, GCFA

Notes from the triage bench

Field note · restore drills

An untested backup is a rumor

The first question I ask on an incident call is not “do you have backups?” It is “when did you last restore one, and how long did it take?” About half the time, the honest answer is never. The backup job was green every night. It was also backing up a folder the line-of-business app stopped using two years ago.

Field note · local admin

A shared admin password is a hallway

Imaging every PC from one golden image is efficient, and it also gives every PC the same local administrator password. An attacker who dumps it once can log on to all of them. Windows LAPS is built into Windows now. Turning it on is the cheapest containment control there is.

Field note · remote access

Your RMM tool is someone else’s front door

More than once the attacker did not bring malware at all. They installed a legitimate remote-support tool, the same kind your MSP uses, and it sailed past antivirus. Keep a written list of approved remote tools and alert on DNS lookups for everything else. Event ID 22 makes that easy.

Long-form field notes

Talk to a responder

For an active incident, email cert@norton-tech-support.com with your callback number and a one-line description. Do not send credentials or samples by email. For hardening, backup runbooks or clinic and fleet assessments, write to triage@norton-tech-support.com. We are at 11951 Freedom Dr, Suite 420, Reston, VA 20190, and most of our clients are within an hour of the Dulles corridor.