You usually can't detect them other than running the program and watching it die, or running the program with strace and looking for the files it's trying to st

You usually can't detect them other than running the program and watching it die, or running the program with strace and looking for the files it's trying to stat/open. You can actually pipe the output of strace into exodus and it will include the files that were accessed by the program in the bundle. For example: strace -f nmap --script default 127.0.0.1 2>&1 | exodus nmap