Is it possible to find a script that was created, ran and then deleted?

As you are asking this in NCM I presume you mean a script that was run via a job?

If so, then the only way I've seen it as it annoys me the NCM audit stuff doesn't seem to go in the logs, is via the API using SWQL Studio. Once connected, enter 'jobs' in the search box and you'll see:

\\\\right click and 'generate select statement' and then hit F5 or the green arrow to execute. If you wish to restrict it to the last x days, then remove the default TOP 1000 and use something like the following:

SELECT NCMJobID, NCMJobName, NCMJobType, NCMJobCreator, NCMJobDefinitionXML, NCMJobSchedule, NCMJobDateCreated, NCMJobDateModified, Enabled, IsHidden
FROM Cirrus.NCM_NCMJobs
WHERE NCMJobDateCreated >= GETDATE()-2

Just adjust the WHERE clauses you search on to suit yourself. The number at the end is days so the above would search the last two days.

As you are asking this in NCM I presume you mean a script that was run via a job?

If so, then the only way I've seen it as it annoys me the NCM audit stuff doesn't seem to go in the logs, is via the API using SWQL Studio. Once connected, enter 'jobs' in the search box and you'll see:

\\\\right click and 'generate select statement' and then hit F5 or the green arrow to execute. If you wish to restrict it to the last x days, then remove the default TOP 1000 and use something like the following:

SELECT NCMJobID, NCMJobName, NCMJobType, NCMJobCreator, NCMJobDefinitionXML, NCMJobSchedule, NCMJobDateCreated, NCMJobDateModified, Enabled, IsHidden
FROM Cirrus.NCM_NCMJobs
WHERE NCMJobDateCreated >= GETDATE()-2

Just adjust the WHERE clauses you search on to suit yourself. The number at the end is days so the above would search the last two days.