T1489 Service Stop in real malware
ATT&CK technique T1489 Service Stop appears in 1 publicly analyzed sample on MalwareAnalyzer by Cyble, 0.0% of the analyzed corpus. Seven-day prevalence is rising (1 recent vs 0 prior). Most associated families: HUILoader.
Tactics: impact
Prevalence in the corpus
- Samples exhibiting T1489: 1
- Share of analyzed corpus: 0.0%
- Last 7 days: 1 · prior 7 days: 0 (rising)
Malware families using T1489
- HUILoader - 1 sample
Example samples
Canonical technique definition: MITRE ATT&CK T1489 (ATT&CK v19.1, CC BY 4.0).
Frequently asked about T1489
- How common is ATT&CK T1489 (Service Stop) in real malware?
- ATT&CK technique T1489 Service Stop appears in 1 publicly analyzed sample on MalwareAnalyzer by Cyble, 0.0% of the analyzed corpus. Seven-day prevalence is rising (1 recent vs 0 prior). Most associated families: HUILoader.
- Is T1489 becoming more common?
- Prevalence is rising: 1 sample in the last seven days against 0 in the seven days before. This measures submissions to MalwareAnalyzer by Cyble, so it reflects what is being submitted here rather than global attacker behaviour.
- Which malware families use T1489?
- In this corpus T1489 is most associated with HUILoader (1). Counts are analyzed samples per family in which the technique was observed.
- What share of analyzed samples use T1489?
- 0.0% of the publicly analyzed corpus (1 of 100981 samples) exhibits T1489. Technique attribution comes from behavior captured during real sandbox detonation and from static analysis, not from a vendor label.
All ATT&CK techniques in the corpus · Latest analyzed threats