Using PowerShell – Identifying Brute Force Attack Logs on the domain controller may be monitored for multiple failure instances to identify a brute force attack. A domain controller logs a failed Kerberos ticket with log event 4771 an example of a way to investigate a potential brute force attack is to run the command below on a domain controller to look for all failed logins within the last hour