In the use of C # system message capture, how to distinguish the message is off or restart?

In the use of C # system message capture, how to distinguish the message is off or restart?

//系统关机事件捕获， 并发送数据给串口
        private const int WM_QUERYENDSESSION = 0x0011;
        protected override void WndProc(ref System.Windows.Forms.Message m)
        {
            try
            {
                switch (m.Msg)
                {
                    case WM_QUERYENDSESSION: //暂时屏蔽关机拦截
                        m.Result = (IntPtr)1;
                        break;
                }
                base.WndProc(ref m);
            }
            catch (Exception e)
            {
                MessageBox.Show(e.Message);
            }
        }