Here's what the "warden" does. It was explained by a Blizzard developer a while ago after massive uninformed whining.
It looks at all currently running processes on the computer, and compares them to a locally stored list of known hacking programs - this is all done CLIENT SIDE, with no information being sent.
The only information warden sends over the internet is a simple "yes" there is a hack or "no" there isn't.