I know that it can checksum files, search through drivers, scan memory addresses, etc. I think I can read registry keys as well. That’s just what I know of the 2005-2008 era of Warden implementation. See vanilla implementation: https://github.com/vmangos/core/pull/1295