IT Solutions Technology Blog

Identifying Brute Force Attacks – Logs on the domain controller may be monitored for multiple failure instances to identify a brute force attack. A domain controller logs a failed Kerberos ticket with log event 4771 an example of a way to investigate a potential brute force attack is to run the command below on a domain controller to look for all failed logins within the last hour

Get-WinEvent -Filterhashtable @{LogName=’Security‘;id=4771;starttime=(Get-Date).AddHours(-1);endtime=(Get-Date) }