Metacrafter Registry

Datatypes

.NET TypeLib ID (assembly GUID)

ID dotnet_typelib_id

DatatypeNot PIIidentifierDraft

This record is a draft: it has not been reviewed yet and may be incomplete or wrong. Do not rely on it for compliance decisions. Help improve it (see CONTRIBUTING.md).

GUID in the GuidAttribute of a .NET assembly, written by Visual Studio into Properties/AssemblyInfo.cs when a project is created ([assembly: Guid("...")]). It becomes the ID of the type library if the assembly is exposed to COM. Because it stays the same across all builds of a project, threat hunters use it to link malware and offensive tools to their source project; VirusTotal reports it as dot_net_guids.typelib_id. The text form is a standard UUID, usually in lowercase.

Parent datatype
Universally unique identifier (UUID) uuid
Categories
Software development, Universal unique identifiers
Countries
Global (not tied to a country)
Languages
Common to most languages
Quality
75/100 · missing: mapping (Wikidata, Schema.org, ...), translation, detector coverage
Metacrafter rules
no detection rule yet
Supported by tools
no tool record lists this type yet

Regular expression

^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$

Python re syntax.

Examples

ValueDescription
aec32155-d589-4150-8fe7-2900df4554c8TypeLib ID of GhostPack Seatbelt (Seatbelt/Properties/AssemblyInfo.cs)
658c8b7f-3664-4a95-9572-a3e5871dfc06TypeLib ID of GhostPack Rubeus (Rubeus/Properties/AssemblyInfo.cs)
{aec32155-d589-4150-8fe7-2900df4554c8} invalidBraced GUID form, which the GuidAttribute does not use

Sources

Use this record