Server side trace with SP:StmtStarting and SQL:StmtStarting with the filter TextData like %xp_cmdshell% seems like the only alternative. Ot the corresponding X-event session on SQL 2012 or later.
[font="Times New Roman"]Erland Sommarskog, SQL Server MVP, www.sommarskog.se[/font]