@lvferdi a table that I proposed in a PR can also do that https://github.com/facebook/osquery/pull/4135

type

is "6" for an airdrop attachment and the sender will be the name of the user who sent the file. It won't tell you the file's current path however.