I don’t think osquery hooks that. There is a

deb_packages

table which gives you installed packages, but not what files map to what package. (There is an

rpm_package_files

table, so there’s some prior art if someone wanted to write a

deb_package_files

table. But none exists today)