EAC (EasyAntiCheat) in Rust catches cheat software through a combination of a kernel driver and behavioral analysis, and it bans not just the game account but the hardware itself through HWID, which is why a new Steam profile on the same PC almost always gets banned again within a day. Below we break down the architecture of the protection itself: what exactly the driver checks when rust.exe launches, why bans in Rust often arrive in waves instead of instantly at the moment of detection, and why updating cheat software for every EAC patch is critical for undetected status, not just a formality in a product description.
We keep working options for the current version of EAC starting at 216 rubles on our cheats for Rust page, where you can also see the live status of every product in the catalog. The breakdown below is based on the client after the Rust forced wipe on July 2, 2026, the first Thursday of the month, when Facepunch traditionally rolls out both a client update and, under the hood, a matching EAC driver update.
How EAC Works in Rust and What the Driver Actually Checks
EasyAntiCheat has belonged to Epic Games since 2019, and the protection has been running in Rust since 2018, remaining a kernel mode system the whole time rather than a lightweight user level check. When rust.exe starts, the system launches the EACService service and the EasyAntiCheat.sys driver with Windows kernel level privileges, even before the player sees the loading screen. That means the check is not a one time thing at match entry, it runs constantly while the client is open, and it catches any process that touches the game's memory.
The Signature Layer: A Database of Known Cheats and Loaded Modules
The first level of detection compares the modules, DLLs, and open handles loaded into the process against a database of known cheat and loader signatures. A public loader or a mass market public cheat almost always ends up in that database quickly, because the same binary spreads to thousands of computers without any change to the code. Private software built individually for each buyer avoids a direct hash match, but it still goes through the second layer of checks described below.
EAC also keeps a separate blacklist of known cheat drivers and kernel level memory reading utilities: if the system sees something from that list among the active Windows drivers at boot, the process gets blocked before match entry, not as a result of suspicious behavior inside the game. This also covers checks for debuggers and virtual machines: some builds specifically look for signs of VMware, VirtualBox, or a connected kernel level debugger, because that is a typical environment for reverse engineering the cheat itself, not for a regular gaming session.
Behavioral Analysis and Why the Ban Does Not Land Right Away
The second layer looks not at the file but at the process behavior: nonstandard calls that read and write someone else's memory, thread injection, function pointer swapping, and calls to kernel mode drivers coming from third party software. This is exactly where Rust is known for its delayed ban model: detection and the actual account block do not happen at the same time, EAC and Facepunch often collect data and roll out a wave of bans days or weeks after suspicious activity was first flagged. In practice this means a clean match with no instant ban does not prove a specific build is fully safe, you need to watch the status over time rather than judge it from a single session.
HWID Ban: What Actually Goes Into the Hardware Fingerprint
When the block does land, Rust bans not just the game profile but a whole combination of hardware identifiers: drive serial numbers, the motherboard identifier, the network card's MAC address, and a number of system values all get combined into a single HWID fingerprint. Because of this, changing your Steam password, buying a new game key, or doing a clean Windows reinstall will not lift the block, since the system recognizes the same hardware the next time it connects to the server. Formally this is the same family of protection found in other EAC titles, but in Rust specifically, with its high cost of rebuying a whole set of DLC and items, an HWID ban feels especially painful. There is no simple way to remove a block like this: you need either a spoofer that changes what EAC sees at the driver level when connecting to the server, or a physical replacement of some of the hardware components, while half measures like manually changing the MAC address through Device Manager usually do not fool the system, because the fingerprint is built from several parameters at once.
Why Regular Cheat Software Updates Are Not Optional, They Are a Requirement
Facepunch updates Rust practically every month: the forced wipe on the first Thursday of the month brings not only a map reset but also a client patch, and along with it the EAC driver version itself often gets updated too. Any such update changes part of the game's internal memory structures, function addresses, and the way the legitimate client accesses its own data.
For a cheat, this means that an injection and memory reading method that worked yesterday can start looking like an anomaly to the driver right after a patch, even if the software developer changed nothing specifically aimed at detection of that particular build. We see this regularly right in our own catalog: some listings stay undetected after a patch, while others temporarily shift into an updating status or, as is the case right now with BLUME, get marked as not working until a fix is released. The difference between these two groups almost always comes down to one thing, whether the developer shipped a patch for the new EAC version within the first day or not.
There is also a less obvious factor: EAC does not run only in Rust, the same protection is installed in dozens of other projects built on Unreal and beyond. A detection rule added to the database for a completely different EAC game technically applies to all titles at once, Rust included. So a cheat can run into trouble not because of changes made in Rust specifically, but because of a general update to EAC as a product. There is no way for a player to track this from the outside, which is why we rely on the fact of a live test of a specific build rather than on the date of the last Rust client patch by itself.
What This Means for Choosing a Specific Product
The practical takeaway is simple: the age of a build and how fast the cheat's development team reacts to Rust patches matter more than a nice looking feature list in the description. At ForgeCheats we check the status of every listing after each forced wipe and patch manually, logging into a test account and running the basic functions on a live server, rather than relying on the software vendor's word, which is why the undetected status on a product card reflects a real test, not marketing.
What to Choose for Rust for This Task
Below are real listings from our catalog as of today, with prices and status as of the time of checking, not some averaged recommendation disconnected from hardware and the player's actual task. The logic is simple: the fresher a specific product's update for the current EAC version, the less need there is for extra precautions on top.
- You only need basic awareness without the risk of full AIM: MEMEZ LITE starting at 216 rubles gives you ESP and Box, and its minimal feature set is easier to hide from EAC's signature layer simply because there is so little for it to detect in the first place.
- The universal option we ran for this breakdown: BTG starting at 600 rubles holds undetected status and covers AIM and ESP together, with FOV configuration and a full loot list visible through walls.
- A full package for raids and active PvP: STEALTH FULL starting at 500 rubles adds Skeleton, resources, and Min Recoil on top of the base set of visuals and aim.
- You need a spoofer built in right away in case of an HWID ban: ANCIENT starting at $5 includes a built in HWID-Spoofer along with AIM, ESP, and a radar, a sensible choice for an account that has already been blocked before.
- Worth waiting on: BLUME is currently in "not working" status, a clear example of why we do not recommend buying a product without a recent update for the current EAC version until the development team ships a patch.
Our Rust cheats → page collects all current options with price, undetected status, and a short feature comparison, and the list gets updated after every forced wipe and EAC patch. Questions about choosing a specific build for your task and hardware get discussed in our community: Telegram (200+ members) and Discord (637+ members), where we also publish statuses right on patch day.
Frequently Asked Questions About EAC and HWID Bans in Rust
Does EAC Ban in Rust Immediately Upon Detection, or Later?
Usually later. Rust is known for its delayed ban model: the moment suspicious activity gets flagged and the actual account block can be days or weeks apart, so a clean session with no instant ban does not guarantee a build has not already been logged for a future wave. This delay is convenient for the protection itself: it makes it harder for cheat development teams to pin down exactly which action triggered a flag, because too much time passes between testing a build and the system's reaction for a direct link to be drawn. At ForgeCheats we update the status of a specific product with this delay in mind, not just based on how recent the last patch was.
Will a New Steam Account Help After an HWID Ban in Rust?
No, because the block is tied to the hardware fingerprint, not just the login. A new account on the same drive and the same motherboard will be recognized by EAC the next time it connects and get banned again, usually faster than the first time. Current options with honest status are collected in our Rust cheats catalog, where you can also see which products come with a built in spoofer.
How Often Do You Need to Update Cheat Software for EAC in Rust?
At minimum for every forced wipe and client patch, so roughly once a month, and sometimes more often when there are unplanned hotfixes. The EAC driver changes along with the client, and an old injection method risks turning into noticeable anomalous behavior as soon as the day after a patch.
Can Antivirus Software or a Third Party Overlay Trigger a False Ban From EAC?
Technically yes, the EAC kernel driver is sensitive to any software that reaches into process memory at the kernel level, including some aggressive antivirus programs and recording overlays. In practice, the overwhelming majority of blocks in Rust are tied to actual cheat software, not to a false trigger from some harmless third party application.
What Should You Do If a Product Gets an "Updating" Status?
Wait for the patch to be released and do not run the old version on the current Rust client: it is precisely during the updating status that the risk of detection by EAC's behavioral layer is at its highest. The easiest way to check how current each listing is is to look directly at the catalog page before buying.
