To do this you will need to set up a custom event filter in Task Scheduler.
Triggers > New > Custom > Edit Event > XML
and paste the following:
<QueryList>
<Query Id="0" Path="System">
<Select Path="System">
*[System[Provider[@Name='User32'] and (Level=4 or Level=0) and (EventID=1074)]]
and
*[EventData[Data[@Name='param5'] and (Data='power off')]]
</Select>
</Query>
</QueryList>
This will filter out the power off event only.
If you look in the event viewer you can see under Windows Logs > System under Details tab>XML View that there's this.
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="User32" Guid="{xxxxx-xxxxxxxxxxx-xxxxxxxxxxxxxx-x-x}" EventSourceName="User32" />
<EventID Qualifiers="32768">1074</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2021-01-19T18:23:32.6133523Z" />
<EventRecordID>26696</EventRecordID>
<Correlation />
<Execution ProcessID="1056" ThreadID="11288" />
<Channel>System</Channel>
<Computer>DESKTOP-REDACTED</Computer>
<Security UserID="x-x-x-xx-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-xxxx" />
</System>
- <EventData>
<Data Name="param1">Explorer.EXE</Data>
<Data Name="param2">DESKTOP-REDACTED</Data>
<Data Name="param3">Other (Unplanned)</Data>
<Data Name="param4">0x0</Data>
<Data Name="param5">power off</Data>
<Data Name="param6" />
<Data Name="param7">DESKTOP-REDACTED\username</Data>
</EventData>
</Event>
You can test the query with the query list code above in the event viewer by clicking
Create Custom View... > XML > Edit query manually
and pasting the code, giving it a name Power Off Events Only before you try it in the Task Scheduler.