Application Event ID 1000 — Application error

An application crashed. FaultingApplicationName, FaultingModuleName, ExceptionCode are key.

Why event 1000 matters

Exploitation attempts often cause crashes. FaultingModuleName=ntdll.dll with ExceptionCode=0xC0000005 (access violation) may indicate buffer overflow exploitation. Correlate with Sysmon 1 to identify what was running before the crash.

How to detect it

Alert: crashes in security tools (AV, EDR). Alert: repeated crashes of the same application (exploit attempt). Alert: FaultingModuleName is a recently loaded unknown DLL (injection-caused crash).

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Event
| where EventLog == "Application" and EventID == 1000   // Application error
// EventData holds: Application Name, Faulting Module, Computer
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

index=* sourcetype="WinEventLog:Application" EventCode=1000
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Application error — add EventData fields: Application Name, Faulting Module, Computer`

Related Application Error events