Executors, Lua injection, menus, external ESP: a plain-language map of the cheat landscape for server owners, and the layer where each kind gives itself away.
You do not need to understand every cheat to run a server, but knowing the main families helps you read detection reports and talk to your staff about what they are seeing. Here is the landscape without the hype.
Most FiveM cheats are executors: tools that inject code into the game client so they can run their own Lua scripts as if they were part of a resource. Paid "menus" are usually a polished script running on top of an executor, with buttons for teleporting, spawning vehicles and weapons, giving money through vulnerable events, or annoying other players.
Where they show: in what the injected code does. Events fired by resources that do not exist on your server, natives called in ways no legitimate script calls them, impossible state changes (godmode, infinite ammo, instant teleports) and the fingerprints of known executors.
This is the menu calling your own server events with arguments it chose: paying itself, giving items, reviving, unjailing. It is not a bug in FiveM, it is a resource trusting the client too much. Our guide on locking down server events covers the fixes.
Where it shows: on the server. Event rates no human could produce, rewards without the state that should precede them, events from players who should not have access.
Aimbots and silent aim change where shots land, either by moving the camera or by redirecting the shot. Triggerbots fire when the crosshair crosses a target.
Where they show: in statistics over many shots rather than in a single one: reaction times, the angle between where the player was aiming and where the hit landed, hits through cover. Single-shot rules are a reliable way to ban good players, which is why these detections are built on patterns.
"External" cheats read the game's memory from a separate program and draw boxes, names and health bars on a transparent window over the game. They do not change the game, which makes them quieter.
Where they show: in-game, players who always know where others are behave differently, and screen evidence can reveal overlays. On the computer, the program, the overlay window and its traces are what a forensic scan with TruffScan looks for.
Spoofers change the hardware identifiers and tokens a game sees, so a banned player can come back with a "new" computer.
Where they show: rarely all identifiers change consistently. Linking old and new accounts through the identifiers that did not change, and spotting values a spoofer produces, is how evasion is usually caught.
No single layer catches everything. A good setup combines client-side detection, server-side validation, evidence for every action, and a forensic check when something still feels wrong. That is the whole idea behind how TruffAC is built.
