Blizzard Warden
Warden is Blizzard's client-side anti-cheat, in operation since around 2005 and one of the earliest and most-studied in PC gaming. It is user-mode, installing no kernel driver: while the game runs it periodically scans memory and host state and compares against server-side cheat signatures. It is the historical ancestor of the kernel anti-cheats that followed, and the subject of the landmark MDY v. Blizzard lawsuit.
Warden runs in user mode, not the kernel, while World of Warcraft is open. It scans the game's memory and parts of the host's running state and reports matches against known cheats to Blizzard's servers. It sees less of the machine than a kernel anti-cheat by design, and like all of them it cannot see a separate computer or a capture device outside the host.
Catalogued by Vera from the anti-cheat maker's own documentation and named public reporting (Ars Technica, PC Gamer, Eurogamer, BleepingComputer, and others). Anti-cheats change; these notes reflect the public record as of June 2026. What is here is public evidence, never an accusation about a person.