Intercept Windows Vista shutdown event in C#
You can use WPF's application object and subscribe to its SessionEnding event. You can then look at the SessionEndingCancelEventArgs.ReasonSessionEnding enumeration to determine exactly why the session is ending (LogOff or Shutdown).
What you may want to look at is here - Application Shutdown Changes in Windows Vista. Basically, for what you want, it all revolves around WM_QUERYENDSESSION.
Note that this is exposed in the .net framework - instead you will need to use native functions (p/invoke) and hook the wndproc in your code to respond to the windows message.
For an example (showing a reason to not shutdown), you can see Windows Vista - ShutdownBlockReasonCreate in C#.