Warden snipes them. Warden sniffs around users active apps, compares them to known cheating softwares. When there’s new code and software, warden update takes some time.
Blizzard 1st detect software, reverse engineers it and teaches warden to recognise it.
few things - they track averages. I.e. your IP, play times. If the averages are high (i.e. I used to have very long sessions back on days due reasons), they may run a scan on you. It is likely automated.
Then there’s Warden as mentioned above. Warden detects if you bot, or if you likely bot. Warden does NOT flag you for using most common multibox programs, but there’s certain scripts/automation snippets its not liking .
Legit players have nothing to fear. And in case automated systems pin an innocent, simple e-mail to Blizzard for review would quickly sort this out.
Also there’s flagging/account history they tend to follow in case of doubt.