diff --git a/confirmed_malicious.rego b/confirmed_malicious.rego
index a72eb52..162638e 100644
--- a/confirmed_malicious.rego
+++ b/confirmed_malicious.rego
@@ -17,14 +17,14 @@ deny contains issue if {
 # title: Verified malware
 deny contains issue if {
 	some issue in data.issues
-	issue.tag == "CM0037"
+	issue.tag in {"CM0038", "CM1002"}
 }
 
 # METADATA
 # title: Known-bad compiled binary
 deny contains issue if {
 	some issue in data.issues
-	issue.tag == "CM0038"
+	issue.tag == "CM0037"
 }
 
 # METADATA