I don't understand fully the concept of "unattended" as if somehow that changes the behaviours of the proc itself. I mean staring at a screen waiting for a whisper "are you a bot?" or "you're a bot, i'm telling" isn't exactly a fail safe.
Obvious signs of CR.
- You never move out of Fel Flame etc. The "movement" enabled/disabled function in your botting is locked to disabled, and when you do attempt to move its small incremental steps like its stuttering. I've seen this so many times in raids/LFR you may aswell just hold up a flag saying "i'm CR`n bro..".
- Your interrupts are too precise. Bake some failure into your behaviour as even if a perfect player can achieve this, what are the chances they are in your LFR today.. perception = reality.
- Your movement patterns are linear. If your toon is constantly chasing adds around especially as a melee, again, who does that? ..when you're actual on the keyboard mashing keys to keep some kind of Guitar Hero style rythmn, the chances of you having enough cognitive load + agility to also keep a consistent movement is low. Again, once you're aware of it as a botter you can see it yourself ergo, its also a signal that triggers a "i think that toon isn't doing it for reals"
- Consistency in CR's. No human can naturally maintain a constant set of key hits that follow rotations in a 80% perfect or above sequence no matter if its a Wild Boar or a bad ass Raid Boss... its just to obvious and frequent.
- AOE for no reason, obvious is when I see people cast AOE on a mob that they could take out easily without it. Furthermore is "singular" ... its like watching a Tauren take a giant war hammer to kill a bug... overkill = "hang on, is that a.." trigger.
- AOE self-targets the moment a NPC appears and they move off it... again... if your a DK and casting death & decay before you've engaged attacks and they are either on the target a ways off or underneath you, but you can easily predicate movement off it... ok once..sure... twice... maybe slow learning curve... three times + .... bot.
- Wall running. One could argue "maybe they just put auto run on and are getting a coffee or something" but you can't afford to play that game of "i have an excuse, hear me out..."
Kill vs Death ratio on level parity vs above level parity. Critical and important behaviour trait to self-check on. A lot of games online use this immediately to put an account under suspicion, but if for example you took a toon with low level gear and was able to take on a 2 or more of same level and/or 1-2 above... and survive with perfect self heals and preventitive measures, maybe....just *maybe* that could be argued as normal. Yet again, reminder, this isnt a two-way dialogue... you don't get to defend against your "you are a bot" prosecution.
My theory and i've documented this several times is this. Blizzard have far to many accounts to run diagnostic checks on, the server load for that alone would be be quite expensive on any database, so they have some basic preliminary signatures to look for - aka reports... such as - "Show me all players logged in for 6hrs with a kill death ratio of <= 100:1" something as trivial like that would trigger a batch of toons that one could look closer into. Then you could argueably run a second report "show me all toons that have a xyz repeat count more than 10" meaning is your toon running along the exact same xyz coords in game more than 10 in a sequental order. Ok, again, what human runs from A->B->C->D->E 10x in a row (or even with a margin of +/- 10 on each coord).
Now once they do that first round of passes, you have probably a few hundred or so "toons" that are worth looking into ...so from millions/hundreds of thousands of active toons you then pair it back to hundreds.
Run some more deeper diagnostics on areas like above, gold revenue, mailing relationships, AH behaviours, "did this level 1 toon just transfer N k in gold to a lvl 60+ toon without dialogue or previous relationship heirachies?" and so on.
So... "unattended" or not, is moot.
