Detections

Six checks run on every scan. Each one either matches something known, or it doesn't.

Injected resources

Finds resources running on the client that never appeared in your server manifest.

A manifest diff catches the gap even when the resource renames itself every launch, something a log-line check misses the moment the name changes.

216 enumerated

Executor signatures

Matches byte patterns and structure hashes for known Lua executors and menu loaders.

SIG-DB 2026.09.19

Modified client files

Hashes game and CitizenFX files against known-good builds, so patched binaries stand out.

96 modules hashed

Process anomalies

Reports overlays and modules that attached themselves to FiveM after it launched.

The check runs against the process as it exists right now, not against a snapshot taken at scan start, so a loader that attaches mid-session still shows up in the same report.

FiveM only

Suspicious handlers

Flags event handlers registered for events a normal client would never receive.

Per event

Scan tampering

Notices when a scan is interfered with, killed early or fed a spoofed result.

Every scan