@groob thank you, but I don't see how santa can help me to discover which path does every application access. I think it can only prevent the defined binaries from running, based on their hash or signing certificate.