If you want to monitor file/directory creation or deletion you can create a custom WMI provider for that. Example:
SELECT * FROM __InstanceDeletionEvent
WHERE TargetInstance ISA ‘CIM_DirectoryContainsFile’
AND TargetInstance.GroupComponent = ‘Win32_Directory.Name=”C:\\\\Temp\\\\”’
For more details see: http://www.microsoft.com/technet/scriptcenter/resources/qanda/apr05/hey0404.mspx and Brian’s WMI whitepaper: http://brianwren.members.winisp.net/WMI/WMI%20Events%20in%20MOM%201.2.doc
BTW, I am publishing this for the first time from Word 2007 Beta 2.