FiveM detection rules

fxscan.rce.http-response-to-load· TITAN-RCE-LOADSTRING· lua

A value that originates from an HTTP response reaches a Lua code-execution primitive (load/loadstring). Whoever controls that endpoint controls the server: they can run arbitrary Lua at any time, without shipping a new version of the resource.

Recommendation: Never execute remotely fetched content. If the resource needs remote configuration, fetch data (JSON) instead of code, validate it against a schema, and act on the parsed values.

fxscan.rce.loadstring-tainted· TITAN-RCE-LOADSTRING· lua

`loadstring` compiles a string into an executable Lua chunk. A value that the resource does not fully control reaches it, which means the string being compiled can be influenced from outside the resource.

Recommendation: Remove the loadstring call. If dynamic behaviour is genuinely required, replace it with a fixed table of allowed operations selected by a validated key.

fxscan.rce.encoded-payload-to-load· TITAN-OBF-BASE64-EXEC· lua, javascript, typescript, tsx

A value passes through a decoder (Base64, hex, character codes or XOR) before reaching a code-execution primitive. Decoding immediately before execution has no legitimate purpose - it exists to hide what the code does from a reviewer.

Recommendation: Treat this resource as compromised until the decoded payload has been reviewed. Decode the literal offline and inspect it before running the resource anywhere.

fxscan.rce.aliased-execution-primitive· TITAN-RCE-LOADSTRING· lua, javascript, typescript, tsx

A code-execution function such as `load` or `eval` is assigned to another variable and called through that alias. This is a standard technique for defeating naive string searches for `load(`.

Recommendation: Remove the alias and call the primitive directly, or - preferably - remove the dynamic execution entirely so it can be reviewed statically.

fxscan.rce.dynamic-global-lookup· TITAN-RCE-LOADSTRING· lua, javascript, typescript, tsx

The code reaches a dangerous global through a computed index such as `_G['load']` or `globalThis[name]`. Computed access exists precisely to keep the dangerous name out of the source text.

Recommendation: Replace computed global access with a direct reference, then review whether dynamic execution is needed at all.

fxscan.rce.js-eval-tainted· TITAN-RCE-LOADSTRING· javascript, typescript, tsx

A value the resource does not control reaches `eval`. In a FiveM JavaScript resource this runs with the full privileges of the server runtime.

Recommendation: Delete the `eval` call. Parse data with `JSON.parse` and dispatch through an explicit map of allowed handlers.

fxscan.rce.js-function-constructor· TITAN-RCE-LOADSTRING· javascript, typescript, tsx

`new Function(...)` compiles a string into a callable. When any part of that string is dynamic it is equivalent to `eval` and cannot be reviewed statically.

Recommendation: Replace the constructed function with a normal function. If behaviour must be selected at runtime, use a lookup table keyed by a validated identifier.

fxscan.rce.timer-string-execution· TITAN-RCE-LOADSTRING· javascript, typescript, tsx

`setTimeout`/`setInterval` accept a string, which is then evaluated exactly like `eval`. This form is never necessary and is frequently used to smuggle execution past reviewers.

Recommendation: Pass a function reference instead of a string.

fxscan.rce.executed-literal-is-dangerous· TITAN-RCE-LOADSTRING· lua, javascript, typescript, tsx

A string literal handed to a code-execution primitive decodes into code that itself performs dangerous operations. The payload was decoded statically by the scanner and never executed.

Recommendation: Do not run this resource. Extract the decoded payload, review it, and treat the publisher as untrusted.

fxscan.rce.remote-script-fetch-and-run· TITAN-RCE-LOADSTRING· lua, javascript, typescript, tsx

The file both performs an outbound HTTP request and contains a code-execution primitive. Even when the scanner cannot prove the connection, this pairing is the classic remote-loader shape and warrants manual review.

Recommendation: Confirm whether the fetched content is executed. Ship code inside the resource instead of downloading it at runtime.

fxscan.cmd.execute-from-network-event· lua, javascript, typescript, tsx

A value supplied by a client through a network event reaches `ExecuteCommand`. Any player able to trigger the event can run arbitrary server console commands, including granting themselves administrator rights.

Recommendation: Never pass event data into ExecuteCommand. Map the event to a fixed, hard-coded command and verify the caller with IsPlayerAceAllowed before running it.

fxscan.cmd.execute-from-http-response· lua, javascript, typescript, tsx

Content fetched over HTTP reaches `ExecuteCommand`, which gives the remote endpoint console-level control over the server.

Recommendation: Remove the remote command channel. If remote administration is genuinely required, use a signed, allow-listed command set and verify the signature before acting.

fxscan.cmd.dynamically-built-command· lua, javascript, typescript, tsx

The string passed to `ExecuteCommand` is built by concatenation rather than written as a literal. Whatever feeds the concatenation effectively chooses which console command runs.

Recommendation: Build the command from a fixed template and inject only values that have been validated against an allow-list (for example a numeric player id).

fxscan.cmd.privileged-command-without-permission-check· lua, javascript, typescript, tsx

A privileged console command (ACE/principal management, resource control, server configuration) is executed without any recognisable permission check in the surrounding function.

Recommendation: Guard the call with IsPlayerAceAllowed (or your framework's equivalent) and fail closed when the check does not pass.

fxscan.cmd.registered-command-without-acl· lua, javascript, typescript, tsx

`RegisterCommand` was called with the `restricted` flag set to false (or omitted) while the handler performs privileged actions. Every player on the server can invoke the command.

Recommendation: Pass `true` as the third argument to RegisterCommand and add a matching `add_ace` entry, or check permissions explicitly at the top of the handler.

fxscan.cmd.operating-system-command· lua, javascript, typescript, tsx

The resource spawns operating-system processes (`os.execute`, `io.popen`, `child_process`). A FiveM resource has no legitimate reason to run shell commands on the host, and doing so escapes every FiveM-level sandbox.

Recommendation: Remove the process execution. If an external tool really is required, run it outside the game server and communicate over a restricted, authenticated API.

fxscan.cmd.command-argument-to-execute· lua, javascript, typescript, tsx

Arguments typed by a player into a chat command are passed into `ExecuteCommand`, turning the chat command into a console proxy.

Recommendation: Never forward raw command arguments to ExecuteCommand. Validate and map them to a closed set of allowed operations.

fxscan.net.event-adds-money· lua, javascript, typescript, tsx

A server event handler credits money using a value that came from the client. A player can trigger the event directly and choose the amount.

Recommendation: Derive the amount on the server from server-side state. Never trust an amount sent by the client, and verify the player is entitled to the payout.

fxscan.net.event-adds-item· lua, javascript, typescript, tsx

A server event handler adds inventory items using client-controlled item names or counts, allowing a player to spawn arbitrary items.

Recommendation: Look up the item and quantity on the server based on validated state. Reject item names that are not in an allow-list.

fxscan.net.event-grants-weapon· lua, javascript, typescript, tsx

A server event handler grants a weapon chosen by the client. Any player can call the event and arm themselves with anything.

Recommendation: Decide the weapon server-side and check that the player is allowed to receive it before granting.

fxscan.net.event-changes-job· lua, javascript, typescript, tsx

A server event handler assigns a job or grade taken from the client payload, which lets a player promote themselves to any role, including jobs with administrative powers.

Recommendation: Validate the requested job against the player's eligibility on the server and reject anything else.

fxscan.net.event-changes-group· lua, javascript, typescript, tsx

A server event handler modifies the caller's permission group with data from the client. This is a direct privilege-escalation path to administrator.

Recommendation: Never change permission groups from a network event. Manage groups through the server console or an authenticated admin panel.

fxscan.net.event-writes-database· lua, javascript, typescript, tsx

A server event handler performs a database write using data that came from the client. Besides the obvious data-integrity problem, string-concatenated queries here are a SQL-injection vector.

Recommendation: Use parameterised queries, and derive the values being written from server-side state rather than the event payload.

fxscan.net.event-triggers-client-event-broadcast· lua, javascript, typescript, tsx

A server event handler forwards data received from one client to all clients. Anything a single player sends is therefore delivered to everyone, which is a reliable amplification and spoofing primitive.

Recommendation: Validate and normalise the payload on the server, and send only the fields the other clients actually need.

fxscan.net.unvalidated-numeric-payload· lua, javascript, typescript, tsx

A server event handler uses one of its parameters in an arithmetic or quantity position without converting or range-checking it first. Negative values, fractions and NaN are the usual way money and item duplication bugs are triggered.

Recommendation: Convert the value with `tonumber`/`parseInt`, reject non-finite values, and enforce an explicit minimum and maximum before using it.

fxscan.net.missing-permission-check· lua, javascript, typescript, tsx

A server event handler performs privileged actions but contains no recognisable permission check. Network events can be triggered by any connected client, so an unguarded handler is effectively a public API.

Recommendation: Verify the caller at the top of the handler (IsPlayerAceAllowed, a framework permission helper, or an explicit group check) and return early when the check fails.

fxscan.net.client-supplied-identifier-trusted· lua, javascript, typescript, tsx

The handler uses a player identifier taken from the event payload rather than the implicit `source`. A client can send any identifier and act on behalf of another player.

Recommendation: Always use the implicit `source` for the caller's identity and ignore identifiers sent inside the payload.

fxscan.net.server-event-registered-on-client-channel· lua, javascript, typescript, tsx

An event handler was added with `AddEventHandler` but the event name was never passed to `RegisterNetEvent`/`RegisterServerEvent`, or the reverse. Mismatched registration commonly means the event is either unreachable or reachable by parties the author did not intend.

Recommendation: Register every network-facing event explicitly and keep the registration next to the handler so the intended trust boundary is obvious.

fxscan.exfil.license-key· lua, javascript, typescript, tsx

The resource reads the server license key (`sv_licenseKey`) and sends it off-server. The license key identifies and authenticates the server owner's Cfx account; leaking it allows impersonation of the server.

Recommendation: Remove the transmission entirely and rotate the license key in the Cfx portal. No third-party resource needs it.

fxscan.exfil.database-connection-string· lua, javascript, typescript, tsx

The database connection string - which contains the database host, user and password - is read and transmitted off-server.

Recommendation: Remove the transmission and rotate the database password immediately. Restrict the database user to the minimum required privileges.

fxscan.exfil.environment-variables· lua, javascript, typescript, tsx

Environment variables are read and transmitted off-server. They routinely hold API keys, database credentials and deployment secrets.

Recommendation: Remove the transmission and rotate every secret that the process environment exposes.

fxscan.exfil.server-configuration· lua, javascript, typescript, tsx

The resource reads `server.cfg` (or a similar configuration file) and sends it to an external endpoint. That file typically contains the license key, database credentials and administrator identifiers.

Recommendation: Remove the file read and the transmission, then rotate every credential stored in the configuration.

fxscan.exfil.local-file-content· lua, javascript, typescript, tsx

File content read from disk is sent to a remote endpoint. Regardless of which file it is, this gives the endpoint owner a read primitive on the server filesystem.

Recommendation: Remove the upload. If telemetry is required, send aggregated metrics rather than raw file content, and document the destination.

fxscan.exfil.resource-inventory· lua, javascript, typescript, tsx

The resource enumerates the other resources installed on the server and reports the list to a remote endpoint. This is reconnaissance: it tells an attacker exactly which known-vulnerable resources are present.

Recommendation: Remove the enumeration and the upload. A resource has no legitimate need to inventory its neighbours.

fxscan.exfil.player-identifiers· lua, javascript, typescript, tsx

Player identifiers (Steam, license, Discord, IP) are collected and transmitted off-server. Besides the privacy implications, identifier lists are used to target players across servers.

Recommendation: Send only what your own systems need, to an endpoint you control and have documented for your players. Never forward identifiers to third-party endpoints.

fxscan.exfil.discord-bot-token-transmitted· lua, javascript, typescript, tsx

A Discord bot token appears in this file and the file performs outbound HTTP requests. A leaked bot token grants full control of the bot, including every guild it is in.

Recommendation: Move the token to a server-side environment variable, keep it out of resource files, and regenerate it if the resource has ever been distributed.

fxscan.exfil.webhook-with-sensitive-payload· lua, javascript, typescript, tsx

A Discord webhook URL is used in the same file that reads sensitive server state. Webhooks are the most common exfiltration channel in malicious FiveM resources because they need no authentication and blend into normal logging traffic.

Recommendation: Confirm the webhook belongs to you. Log only what you need, never credentials or identifiers you have not told your players about.

fxscan.persist.writes-to-other-resource· lua, javascript, typescript, tsx

`SaveResourceFile` is called with a resource name other than this resource. A resource writing into its neighbours is a backdoor installation primitive: removing the malicious resource no longer removes the payload.

Recommendation: Remove the write. Audit every resource named in these calls for files that do not belong to them, and compare the whole server against a known-good copy.

fxscan.persist.manifest-modification· lua, javascript, typescript, tsx

The code writes to `fxmanifest.lua` or `__resource.lua`. Editing a manifest at runtime lets a payload register additional scripts that load on the next server start.

Recommendation: Remove the write and compare every manifest on the server against the version shipped by its author.

fxscan.persist.server-config-modification· lua, javascript, typescript, tsx

The code writes to `server.cfg` or a permissions configuration file. Appending an `add_principal` line there grants permanent administrator access that survives resource removal.

Recommendation: Remove the write, then diff your server configuration against a known-good copy and revoke any principal you did not add yourself.

fxscan.persist.creates-executable-script· lua, javascript, typescript, tsx

The resource writes a `.lua`, `.js` or `.ts` file at runtime. Newly created script files are loaded on the next resource start, which turns a one-off compromise into a permanent one.

Recommendation: Ship code as part of the resource instead of generating it. If templating is genuinely needed, write to a data file with a non-executable extension.

fxscan.persist.downloaded-payload-written-to-disk· lua, javascript, typescript, tsx

Content fetched over HTTP is written to the filesystem. Combined with FiveM's automatic loading of resource scripts, this is a complete remote-install channel.

Recommendation: Remove the download-and-write behaviour. Distribute updates through your normal deployment process where they can be reviewed.

fxscan.persist.controls-other-resources· lua, javascript, typescript, tsx

The resource calls `StartResource`/`StopResource` on resources other than itself. Stopping a security or anti-cheat resource is a standard first step for a payload; starting an unknown one is how a dropped backdoor gets activated.

Recommendation: Manage resource lifecycle from `server.cfg` or the console. If a dependency really must be started, restrict it to an explicit allow-list and log every call.

fxscan.persist.grants-permanent-principal· lua, javascript, typescript, tsx

The code adds an ACE principal or ace permission at runtime. Granted principals persist for the lifetime of the server process and are frequently written to configuration so they survive restarts.

Recommendation: Remove the grant. Review `server.cfg` and the live ACE configuration for principals you did not create.

fxscan.secret.discord-bot-token· lua, javascript, typescript, tsx, json, html, cfg, sql, other

A Discord bot token is embedded in the source. Anyone with a copy of this resource has full control of the bot, including every server it has joined.

Recommendation: Regenerate the token immediately and load it from a server-side convar or environment variable that is never shipped with the resource.

fxscan.secret.discord-webhook· lua, javascript, typescript, tsx, json, html, cfg, sql, other

A Discord webhook URL is hard-coded. A webhook URL is a bearer credential: anyone who reads it can post to that channel, and can spam or flood it. On its own this is common practice rather than an attack, so it is reported at low severity unless other rules find sensitive data flowing into it.

Recommendation: Move the webhook URL into a convar or environment variable and rotate it if the resource has been shared publicly.

fxscan.secret.jwt· lua, javascript, typescript, tsx, json, html, cfg, sql, other

A JSON Web Token is hard-coded. Tokens usually carry an identity and a set of permissions and remain valid until they expire or the signing key is rotated.

Recommendation: Remove the token, rotate the signing key, and issue tokens at runtime instead of shipping them.

fxscan.secret.bearer-token· lua, javascript, typescript, tsx, json, html, cfg, sql, other

An HTTP bearer token is hard-coded. Bearer tokens grant access to whatever API they belong to with no additional proof of identity.

Recommendation: Rotate the token and read it from configuration at runtime rather than embedding it in the resource.

fxscan.secret.database-connection-string· lua, javascript, typescript, tsx, json, html, cfg, sql, other

A database connection string with embedded credentials is hard-coded. Anyone with the resource can connect to the database directly, bypassing every check the server performs.

Recommendation: Move the connection string to a convar or environment variable, rotate the password, and restrict the database user to the host that actually needs it.

fxscan.secret.private-key· lua, javascript, typescript, tsx, json, html, cfg, sql, other

A PEM-encoded private key is embedded in the resource. Private keys are the strongest credential a system has; distributing one in a resource archive compromises everything that trusts it.

Recommendation: Revoke and regenerate the key pair, and never ship private keys inside a resource.

fxscan.secret.generic-api-key· lua, javascript, typescript, tsx, json, html, cfg, sql, other

A variable whose name indicates a credential is assigned a high-entropy literal. The value survived the placeholder and low-entropy filters, so it is likely a real key rather than an example.

Recommendation: Move the value into configuration, rotate it, and add the configuration file to your ignore list so it is never packaged.

fxscan.logic.hardcoded-admin-identifier· lua, javascript, typescript, tsx

A specific player identifier is hard-coded and appears near privileged behaviour. A backdoor that only activates for one identifier is invisible in normal operation and survives every permission system the server owner configures.

Recommendation: Remove the identifier. Manage administrators through your framework's permission system or the server ACE configuration, where the server owner can see and change them.

fxscan.logic.hidden-privilege-grant· lua, javascript, typescript, tsx

The code compares a player identity against a hard-coded value and grants privileges when it matches. This is the canonical shape of a resource backdoor.

Recommendation: Remove the branch entirely. Then audit the ACE configuration and the framework's admin table for entries you did not create.

fxscan.logic.developer-bypass· lua, javascript, typescript, tsx

A debug or developer flag short-circuits a permission or validation check. Flags like this are frequently shipped enabled, and are equally frequently left in deliberately.

Recommendation: Remove the bypass before distribution. If a debug mode is genuinely needed, gate it behind a server convar that defaults to off and log loudly when it is active.

fxscan.logic.server-identity-gated-payload· lua, javascript, typescript, tsx

The resource inspects the server's own identity (hostname, license key, endpoint or convar) and branches on it. This lets a payload stay dormant everywhere except the targets the author chose - including staying dormant on a reviewer's test server.

Recommendation: Remove the check. A resource should behave identically on every server that installs it.

fxscan.logic.time-triggered-payload· lua, javascript, typescript, tsx

The code compares the current date or time against a fixed value and performs a privileged or destructive action when the comparison succeeds. Time-delayed activation is used to get a payload past review and only detonate later.

Recommendation: Remove the time-based branch. Legitimate scheduling belongs in a documented, configurable cron-style mechanism, not in a hidden comparison.

fxscan.logic.silent-player-removal· lua, javascript, typescript, tsx

The resource can remove players from the server (`DropPlayer` or an equivalent ban call) from a code path with no permission check. A resource with an unguarded kick primitive can be used to grief a server.

Recommendation: Require an explicit permission check before dropping a player, and log every removal with the acting identity.

fxscan.obf.long-base64-blob· lua, javascript, typescript, tsx

The file contains one or more long Base64 runs. Base64 is a legitimate encoding for binary assets, but a long blob inside a script is the standard way to hide a payload from a reviewer.

Recommendation: Decode the blob and confirm what it contains. If it is code, treat the resource as untrusted.

fxscan.obf.long-hex-blob· lua, javascript, typescript, tsx

The file contains long hexadecimal runs or `\xNN` escape sequences. Like Base64, this is a common way to keep a payload out of plain sight.

Recommendation: Decode the blob and review its content before running the resource.

fxscan.obf.high-string-entropy· lua, javascript, typescript, tsx

The string literals in this file are close to random. Normal source strings contain readable text; near-random strings usually mean the real content has been encoded.

Recommendation: Review the file manually. If you cannot explain what the strings are for, do not run the resource.

fxscan.obf.character-code-construction· lua, javascript, typescript, tsx

The file builds strings from numeric character codes (`string.char` / `String.fromCharCode`). This defeats plain-text searching for the strings the code actually uses.

Recommendation: Reconstruct the strings and confirm what they contain, particularly any URLs or function names.

fxscan.obf.xor-decoder· lua, javascript, typescript, tsx

The file contains a loop that combines XOR with character-code conversion - a hand-rolled decoder. Legitimate resources have no reason to decrypt their own strings at runtime.

Recommendation: Extract the key and decode the payload offline. Treat the resource as untrusted until you know what the decoder produces.

fxscan.obf.machine-generated-identifiers· lua, javascript, typescript, tsx

Many identifiers have no readable structure, which is typical of automated obfuscators. This alone is not malicious - it is common in bundled JavaScript - but it makes review considerably harder.

Recommendation: Ask the author for unobfuscated sources. An obfuscated server-side script cannot be meaningfully audited.

fxscan.obf.extreme-line-length· lua, javascript, typescript, tsx

The file contains a line thousands of characters long. This is normal for a minified web bundle and abnormal for a FiveM server script.

Recommendation: If this is a server-side script, request the original unminified source before deploying it.

fxscan.obf.dynamic-function-name-resolution· lua, javascript, typescript, tsx

Functions are called through a runtime-computed name rather than written out. This hides which API the resource actually uses and prevents any static review of its behaviour.

Recommendation: Replace dynamic dispatch with direct calls, or restrict it to an explicit table of allowed functions.

fxscan.obf.overall-score· lua, javascript, typescript, tsx

Several independent obfuscation signals fired on this file at once. Any one of them is explainable; the combination means the file was deliberately made hard to read.

Recommendation: Do not deploy obfuscated server-side code you cannot review. Request the original source from the author.