A mod menu is the cheat a FiveM server sees most: a floating panel that spawns vehicles, hands out weapons, teleports across the map, and pushes money into an inventory. You do not catch one with a single trick. You catch it with three layers of coverage running at once, kept up to date, because the people who write these menus rewrite them the moment a detection lands.
What a mod menu actually is
Before you can detect a mod menu you have to be precise about what it is. On FiveM the term covers a family of internal cheats that run inside the game client and give the player a graphical interface for actions they should never have. Public families like Eulen, Redengine, and HamMafia all ship some version of this: a panel, a feature list, and a loader that gets it running.
The menu itself is the easy part to see. The hard part is how it gets into the process in the first place, and that is where coverage has to start.
How mod menus get in
A menu usually reaches the game by one of three paths.
Lua executors
FiveM runs a lot of game logic in Lua. An executor abuses that by loading attacker-controlled Lua into the running client, so the menu rides on the same scripting layer your legitimate resources use. Cheat authors like this because it never touches native game memory directly. The Lua state is already there, already trusted, and already wired to call into game functions.
In-process injection
The heavier approach loads a native module straight into the FiveM process. Once code is running inside the process it can hook functions, patch memory, and draw its own interface using the same rendering path the game uses. This is more powerful than a Lua executor, and it is a door any serious anticheat has to cover.
NUI DevTools
FiveM user interfaces are built on a browser layer called NUI. That layer ships with developer tooling, and a careless or deliberately misconfigured client can open DevTools against game UI, then read and manipulate the interface from the inside. It is quieter than injection, but it is still a way in, and it needs covering just the same.
Layer one: known menus and loaders
Every menu needs a loader, the small piece of code that gets the rest of the cheat running. Loaders are shared across many users of the same public cheat, which makes catching the known ones worth a lot. Raven Anticheat catches known loaders and the menu families that use them.
That coverage is not static. Detection updates ship on a one to seven day cadence with a dated public changelog, so a loader caught on Monday does not get a free week to circulate. When a public family like Redengine pushes a new build, the new build gets covered instead of the product leaning on a stale detection that no longer matches.
Catching a known loader is fast and high-confidence, but known cheats are only part of the picture. That is exactly why one layer is never enough.
Layer two: new menus and tampering
The second layer stops asking whether the client is running a known cheat and starts asking whether the running game has been tampered with. Raven Anticheat protects the client against tampering for the whole session, not only at the moment a player connects.
That makes this layer hard to sidestep with a fresh build. A menu that has injected itself or loaded attacker Lua has tampered with the game, whichever build it came from, and a cheat that loads after the player is already in the server is still covered.
- It catches menus that have no known signature yet, whichever build they come from.
- It catches late injection, so a menu loaded mid-session is still seen.
- It pairs with the first layer. One covers the known cheats, the other covers the ones nobody has catalogued yet.
Layer three: what the menu actually does
The first two layers are about the menu. The third is about what it does. Raven Anticheat is dual client plus server-side by default, and the server-side half protects your server from the actions a menu exists to perform.
This matters because a mod menu is, in the end, defined by what it does. It spawns a vehicle the player should not be able to spawn. It hands out weapons nobody earned. It teleports, sets health, and pushes an inventory change the server never authorized. Server-side protection stops those actions on their merits, whether or not the menu that produced them was caught on the client.
The practical effect is a floor under your security. Even a menu with a brand new loader still has to get past server-side protection to do anything useful, and the actions a menu exists to perform are the actions this layer is built to refuse.
Why detection has to be continuous
None of these layers is a one-time fix, and the reason is the loaders. The moment a public cheat sees its loader getting caught, the authors rewrite it. A new build ships, the old detection stops matching, and circulation continues under a fresh pattern. This is not a flaw in signature detection. It is the normal rhythm of the cheat market.
That rhythm is why the one to seven day cadence exists and why the changelog is dated. Continuous updates answer continuous rewrites. The other two layers keep covering your server between updates, so a rewritten loader buys the cheat author much less time than it would against a signature-only product. Detection is a standing operation, not a finished feature.
How Raven Mind keeps false positives down
Run three aggressive detection layers and you risk false positives, and a banned legitimate player is its own kind of failure. Raven Mind manages that tension. It reviews every detection instead of treating each one as an automatic ban.
Clear cases are actioned. If a call is ambiguous, the default is not to ban. The default is to hold and ask. Borderline calls escalate to a Discord review card where a human makes the decision, and the obvious clean cases get cleared without ever reaching an admin queue.
- Clear cheat: actioned with evidence captured.
- Obvious false positive: cleared automatically, no admin time spent.
- Ambiguous call: held and sent to a review card instead of issuing a ban.
The point is not to soften detection. Real menus still get caught by the three layers underneath. Raven Mind sits on top and keeps the cost of catching them off the legitimate player who happened to trip an edge case. Confirmed bans also feed the evidenced Global Ban Database that Raven Anticheat shares across servers, so a menu user caught on one server does not start clean on the next.
What this looks like to run
All three layers and the scoring on top run from a single install. Raven Anticheat is one line in server.cfg, ensure rac, with the framework auto-detected across ESX, QBCore, vRP, QBox, and standalone, and the whole setup takes about two minutes. The detection work described here runs under 0.5ms on the FiveM resource monitor at 200 or more players, so keeping mod menus out does not cost you server performance.