Below is a list of interesting classes useful for malware authors. Please add comments if you believe any classes are missing, as this is not an exhaustive list.
root/CIMv2 Win32_NetworkAdapterConfiguration Win32_LogicalFileSecuritySetting Win32_LocalTime Win32_LaunchCondition Win32_Fan Win32_DuplicateFileAction Win32_DMAChannel Win32_DisplayConfiguration Can detect VirtualBox Graphics Adapter Win32_DiskPartition Win32_DiskDriveToDiskPartition Win32_DiskDrive Probably more concise than the others Win32_Directory Maybe the most important Win32_DFSNode Sets up a Distributed File System Win32_DeviceChangeEvent Detects when flash drives are inserted or removed Win32_DCOMApplication Win32_CurrentTime Win32_CreateFolderAction Caution, this freezes. Win32_ComputerSystemProduct Good for detecting VirtualBox Win32_COMSetting Displays all CLSID info Very slow!!! Win32_ComputerSystem Win32_ComputerShutdownEvent Win32_COMClass Displays all COM classes available Very slow!!! Win32_ClientApplicationSetting Correlates COM classes with executable files Win32_CIMLogicalDeviceCIMDataFile Associates logical devices and data files with the drivers being used by those devices Win32_BIOS Win32_BootConfiguration Win32_BaseService Enumerates all services and the drivers/code used by devices Win32_AllocatedResource deprecated for Win32_PNPAllocatedResource Shows which resources (IRQs or DMA channels) used by specific device Win32_AccountSID Lists all accounts and their respective SIDs Win32_Account Like *AccountSID, but with more information MSFT_WmiFilterEvent CIM_DataFile CIM_DeviceFile CIM_Directory CIM_VideoController Good VirtualBox detection CIM_UserDevice List of currently installed user devices CIM_Thread Abstract class See: Win32_Thread CIM_Processor Details processor CIM_ProcessExecutable Shows all "data files" (DLL) are active within processes CIM_Process Detailed list of processes CIM_Printer Detailed list of printers CIM_PhysicalMedia List of drives (CDROM and disk) CIM_PCVideoController Detailed list of graphics cards CIM_OperatingSystem Detailed list of OS CIM_MediaPresent "Active" drives? CIM_LogicalFile Abstract class See: CIM_DataFile, CIM_DeviceFile, CIM_Directory CIM_Job Abstract class See: Win32_PrintJob, Win32_ScheduledJob CIM_ExecuteProgram Abstract class No found implementations, definitely take a look CIM_DMA Abstract class See: Win32_DMAChannel root/nap Network Access Protection root/WMI Windows Event Tracing classes VERY USEFUL Must enable system tracing See MSNT_SystemTrace class http://msdn.microsoft.com/en-us/library/windows/desktop/aa364158(v=vs.85).aspx