<PackageReference Include="Microsoft.Win32.SystemEvents" Version="10.0.0-preview.1.25080.5" />

SessionEndReasons

public enum SessionEndReasons
Defines identifiers that represent how the current logon session is ending.
Logoff = 1

The user is logging off and ending the current user session. The operating system continues to run.

The operating system is shutting down.