Below is a list of interesting classes useful for malware authors. Please add comments if you believe any classes are missing, as this is not an exhaustive list.
root/CIMv2
Win32_NetworkAdapterConfiguration
Win32_LogicalFileSecuritySetting
Win32_LocalTime
Win32_LaunchCondition
Win32_Fan
Win32_DuplicateFileAction
Win32_DMAChannel
Win32_DisplayConfiguration
Can detect VirtualBox Graphics Adapter
Win32_DiskPartition
Win32_DiskDriveToDiskPartition
Win32_DiskDrive
Probably more concise than the others
Win32_Directory
Maybe the most important
Win32_DFSNode
Sets up a Distributed File System
Win32_DeviceChangeEvent
Detects when flash drives are inserted or removed
Win32_DCOMApplication
Win32_CurrentTime
Win32_CreateFolderAction
Caution, this freezes.
Win32_ComputerSystemProduct
Good for detecting VirtualBox
Win32_COMSetting
Displays all CLSID info
Very slow!!!
Win32_ComputerSystem
Win32_ComputerShutdownEvent
Win32_COMClass
Displays all COM classes available
Very slow!!!
Win32_ClientApplicationSetting
Correlates COM classes with executable files
Win32_CIMLogicalDeviceCIMDataFile
Associates logical devices and data files with the drivers being used by those devices
Win32_BIOS
Win32_BootConfiguration
Win32_BaseService
Enumerates all services and the drivers/code used by devices
Win32_AllocatedResource
deprecated for Win32_PNPAllocatedResource
Shows which resources (IRQs or DMA channels) used by specific device
Win32_AccountSID
Lists all accounts and their respective SIDs
Win32_Account
Like *AccountSID, but with more information
MSFT_WmiFilterEvent
CIM_DataFile
CIM_DeviceFile
CIM_Directory
CIM_VideoController
Good VirtualBox detection
CIM_UserDevice
List of currently installed user devices
CIM_Thread
Abstract class
See: Win32_Thread
CIM_Processor
Details processor
CIM_ProcessExecutable
Shows all "data files" (DLL) are active within processes
CIM_Process
Detailed list of processes
CIM_Printer
Detailed list of printers
CIM_PhysicalMedia
List of drives (CDROM and disk)
CIM_PCVideoController
Detailed list of graphics cards
CIM_OperatingSystem
Detailed list of OS
CIM_MediaPresent
"Active" drives?
CIM_LogicalFile
Abstract class
See: CIM_DataFile, CIM_DeviceFile, CIM_Directory
CIM_Job
Abstract class
See: Win32_PrintJob, Win32_ScheduledJob
CIM_ExecuteProgram
Abstract class
No found implementations, definitely take a look
CIM_DMA
Abstract class
See: Win32_DMAChannel
root/nap
Network Access Protection
root/WMI
Windows Event Tracing classes
VERY USEFUL
Must enable system tracing
See MSNT_SystemTrace class
http://msdn.microsoft.com/en-us/library/windows/desktop/aa364158(v=vs.85).aspx