diff --git a/rules/koadicpostexploitationrootkit.yml b/rules/koadicpostexploitationrootkit.yml
index 444ace2..3433767 100644
--- a/rules/koadicpostexploitationrootkit.yml
+++ b/rules/koadicpostexploitationrootkit.yml
@@ -15,7 +15,7 @@ logsource:
 detection:
     selection:
         CommandLine:
-            - *chcp 437 & schtasks /query /tn K0adic*
-            - *chcp 437 & schtasks /create /tn K0adic*
+            - '*chcp 437 & schtasks /query /tn K0adic*'
+            - '*chcp 437 & schtasks /create /tn K0adic*'
     condition: selection
 level: critical
diff --git a/rules/powershelldownloadingfilefromurlshortenersite.yml b/rules/powershelldownloadingfilefromurlshortenersite.yml
index 9edc861..b8f69b4 100644
--- a/rules/powershelldownloadingfilefromurlshortenersite.yml
+++ b/rules/powershelldownloadingfilefromurlshortenersite.yml
@@ -29,10 +29,10 @@ detection:
             - '*powershell*new-object net.*https://cutt.*'
             - '*powershell*new-object net.*https://rebrand.*'
             - '*powershell*new-object net.*https://bit.ly*'
-            - '*powershell*net.web*https://tinyurl.*
-            - '*powershell*net.web*https://bitly.*
-            - '*powershell*net.web*https://shorturl.*
-            - '*powershell*net.web*https://rebrandly.*
+            - '*powershell*net.web*https://tinyurl.*'
+            - '*powershell*net.web*https://bitly.*'
+            - '*powershell*net.web*https://shorturl.*'
+            - '*powershell*net.web*https://rebrandly.*'
             - '*powershell*net.web*https://cutt.*'
             - '*powershell*net.web*https://rebrand.*'
             - '*powershell*net.web*https://bit.ly*'
diff --git a/rules/powershelllaunchregsvr32.yml b/rules/powershelllaunchregsvr32.yml
index 037ee7f..35f0ff6 100644
--- a/rules/powershelllaunchregsvr32.yml
+++ b/rules/powershelllaunchregsvr32.yml
@@ -15,6 +15,6 @@ logsource:
 detection:
     selection:
         CommandLine:
-            - *powershell*regsvr32*
+            - '*powershell*regsvr32*'
     condition: selection
 level: critical
diff --git a/rules/powershellsleepandlaunchexecutable.yml b/rules/powershellsleepandlaunchexecutable.yml
index 4ae36bc..14f4977 100644
--- a/rules/powershellsleepandlaunchexecutable.yml
+++ b/rules/powershellsleepandlaunchexecutable.yml
@@ -15,6 +15,6 @@ logsource:
 detection:
     selection:
         CommandLine:
-            - *powershell -c sleep -s *;saps *.exe*
+            - '*powershell -c sleep -s *;saps *.exe*'
     condition: selection
 level: critical
diff --git a/rules/registerdllwithspoofedextension.yml b/rules/registerdllwithspoofedextension.yml
index 9e1982b..534b1f5 100644
--- a/rules/registerdllwithspoofedextension.yml
+++ b/rules/registerdllwithspoofedextension.yml
@@ -16,10 +16,10 @@ detection:
     selection:
         CommandLine:
             - '*rundll32*.html,DllRegisterServer*'
-            - '*regsvr32*\\*.jpg*
-            - '*regsvr32*\\*.png*
-            - '*regsvr32*\\*.jpeg*
-            - '*regsvr32*\\*.pdf*
+            - '*regsvr32*\\*.jpg*'
+            - '*regsvr32*\\*.png*'
+            - '*regsvr32*\\*.jpeg*'
+            - '*regsvr32*\\*.pdf*'
             - '*regsvr32*\\*.txt*'
     condition: selection
 level: critical
diff --git a/rules/shedulehiddenpowershellscript.yml b/rules/shedulehiddenpowershellscript.yml
index 29cdb94..ae0ee7f 100644
--- a/rules/shedulehiddenpowershellscript.yml
+++ b/rules/shedulehiddenpowershellscript.yml
@@ -15,6 +15,6 @@ logsource:
 detection:
     selection:
         CommandLine:
-            - *schtasks.exe*/create*powershell*hidden*
+            - '*schtasks.exe*/create*powershell*hidden*'
     condition: selection
 level: critical
diff --git a/rules/wscriptdownloadfileintotemplocationfromwordpresssite.yml b/rules/wscriptdownloadfileintotemplocationfromwordpresssite.yml
index b2a4918..ffbdf4b 100644
--- a/rules/wscriptdownloadfileintotemplocationfromwordpresssite.yml
+++ b/rules/wscriptdownloadfileintotemplocationfromwordpresssite.yml
@@ -15,6 +15,6 @@ logsource:
 detection:
     selection:
         CommandLine:
-            - *cmd /c wscript.exe *\AppData\Local\Temp*/wp-data/*
+            - '*cmd /c wscript.exe *\AppData\Local\Temp*/wp-data/*'
     condition: selection
 level: critical