With the help of this article I was able to work up a Console App in C# using VS 2012 to alert me when a specific type of process (cmd.exe) was started, was modified or was deleted. I am not versed in the ins and outs of the Win32_Process WMI class so could not figure out how to know if the process was spawned from sqlservr.exe or not, but my guess is that it is possible given the existence of a property I found named IsParentProcessIdNull.
My code, including the WMI stub-class generated on my Windows 8 machine using the VS 2012 tools, is attached as a rar archive.
Here is a preview of the output while the program was running and I opened a cmd.exe window:
There are no special teachers of virtue, because virtue is taught by the whole community.
--Plato