Application Event ID 1002 — Application hang — SecOps Tools

Why event 1002 matters

Security tool hangs (AV, EDR, monitoring agents) may indicate resource exhaustion attacks or deliberate disruption.

How to detect it

Alert: hangs in security tools. Investigate resource usage on affected systems.

Log source

Application

Logged by default in the Application channel; no audit policy required.

Fields to pivot on

Application NameFaulting ModuleComputer

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL

Event
| where EventLog == "Application" and EventID == 1002   // Application hang
// EventData holds: Application Name, Faulting Module, Computer
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Application" EventCode=1002
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Application hang — add EventData fields: Application Name, Faulting Module, Computer`

Hunt event 1002 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Frequently asked questions

What is Application Event ID 1002?

Application hang. An application stopped responding. ApplicationName and HangType are key.

Which log records event 1002?

Event 1002 is written to the Application channel by Application. Logged by default in the Application channel; no audit policy required.

How do you detect activity around event 1002?

Alert: hangs in security tools. Investigate resource usage on affected systems.