Users table

Overview

The MDR > Monitored Assets > Users page on Stoik Protect lists all Active Directory users monitored by the MDR service. Each user is assessed for identity-related risks such as weak or aged passwords, stale accounts, and more.

All values displayed in this table are retrieved directly from CrowdStrike. Stoik displays them as-is. We do not calculate or modify these values.

Users table

Each row in the table displays the following information:

Column	Description
Status	Whether the user account is Active or Inactive. Inactive users are archived accounts no longer in use.
Name	The display name of the user in Active Directory.
Risk	A risk score severity level: Normal, Medium, or High, based on the combined risk factors detected for this user. Users with a risk score greater than 7.5 are considered high risk, indicating a high probability of compromise.
Attributes	Special flags assigned to the user by security analysts (see below).
Risk factors	The specific identity risks detected on this user (see below).

You can search for a specific user by name using the search bar at the top of the table.

Attributes

Attributes are special flags used by security analysts to track specific users or set traps for attackers. They appear as icons in the Attributes column.

Attribute	Meaning
Marked	Users singled out by security analysts for easy identification throughout the console. This flag remains active for 48 hours by default.
Watched	Users requiring special attention, such as those who have resigned, are under notice, or are suspected of being motivated to cause organizational harm.
Honey Token	Deceptive accounts used to lure attackers. Any activity or change related to a Honey Token account triggers a dedicated detection indicating malicious network activity.

Risk factors

Risk factors are specific identity vulnerabilities detected on a user account. Each factor appears as a badge in the Risk factors column. The more risk factors a user has, the higher their overall risk score will be.

Risk factor	Meaning
Insufficient password rotation	The user's password is set to never expire, providing attackers an unlimited timeframe to conduct brute-force attacks. It is recommended to enforce a policy requiring users to change passwords periodically.
Aged password	The user's password has not been changed for an extended period of time.
Exposed password	The user's password has been found in a known data breach or in Group Policy Preference objects, making it potentially visible to unauthorized users.
Password brute force	A brute force attack has been detected against this user's account.
Shared user	Applied to a user who logs in from multiple locations simultaneously or in a suspicious pattern.
Golden ticket	A Kerberos Golden Ticket attack has been detected, which could allow an attacker to impersonate this user indefinitely.
Stale account	An account that has been dormant or inactive for more than three months. Stale users are risky because they are rarely monitored by the owner, allowing malicious activity to go unnoticed. It is recommended to periodically review stale users and delete or disable accounts no longer in use.
Weak password	The user's password has been identified as weak or vulnerable to dictionary attacks. It is recommended to mandate the use of strong, complex passwords.