diff --git a/anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml b/anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml
index 793fba42..45a70f3e 100644
--- a/anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml
+++ b/anti-analysis/anti-emulation/wine/check-if-process-is-running-under-wine.yml
@@ -18,7 +18,7 @@ rule:
       - and:
         - api: GetModuleHandle
         - api: GetProcAddress
-        - string: wine_get_unix_file_name
+        - string: "wine_get_unix_file_name"
         - or:
-          - string: kernel32.dll
-          - string: ntdll.dll
+          - string: "kernel32.dll"
+          - string: "ntdll.dll"
diff --git a/anti-analysis/anti-forensic/patch-process-command-line.yml b/anti-analysis/anti-forensic/patch-process-command-line.yml
index 2463bafc..e0a4457f 100644
--- a/anti-analysis/anti-forensic/patch-process-command-line.yml
+++ b/anti-analysis/anti-forensic/patch-process-command-line.yml
@@ -34,7 +34,7 @@ rule:
       - and:
         - characteristic: indirect call
         - api: GetProcAddress
-        - string: NtQueryInformationProcess
+        - string: "NtQueryInformationProcess"
         - api: ReadProcessMemory
         - or:
           - and:
diff --git a/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml b/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml
index db5848d4..789c5df5 100644
--- a/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml
+++ b/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-device.yml
@@ -15,4 +15,4 @@ rule:
   features:
     - and:
       - api: CreateFile
-      - string: \\.\GLOBALROOT\device\vmsmb
+      - string: "\\\\.\\GLOBALROOT\\device\\vmsmb"
diff --git a/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-dns-suffix.yml b/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-dns-suffix.yml
index 9c61be58..0aee5cfa 100644
--- a/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-dns-suffix.yml
+++ b/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-dns-suffix.yml
@@ -15,6 +15,6 @@ rule:
   features:
     - and:
       - api: GetAdaptersAddresses
-      - string: mshome.net
+      - string: "mshome.net"
       - offset: 0x38 = DnsSuffix
       - match: contain loop
diff --git a/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-genuine-state.yml b/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-genuine-state.yml
index 46b923af..143738ec 100644
--- a/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-genuine-state.yml
+++ b/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-genuine-state.yml
@@ -20,4 +20,4 @@ rule:
       - basic block:
         - and:
           - api: UuidFromString
-          - string: 55c92734-d682-4d71-983e-d6ec3f16059f
+          - string: "55c92734-d682-4d71-983e-d6ec3f16059f"
diff --git a/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-process-name.yml b/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-process-name.yml
index edab03bf..68f354b9 100644
--- a/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-process-name.yml
+++ b/anti-analysis/anti-vm/vm-detection/check-for-windows-sandbox-via-process-name.yml
@@ -15,4 +15,4 @@ rule:
   features:
     - and:
       - match: enumerate processes
-      - string: CExecSvc.exe
+      - string: "CExecSvc.exe"
diff --git a/anti-analysis/packer/aspack/packed-with-aspack.yml b/anti-analysis/packer/aspack/packed-with-aspack.yml
index d41aa09d..2dfdf847 100644
--- a/anti-analysis/packer/aspack/packed-with-aspack.yml
+++ b/anti-analysis/packer/aspack/packed-with-aspack.yml
@@ -19,5 +19,5 @@ rule:
       - section: .adata
       - section: .ASPack
       - section: ASPack
-      - string: The procedure entry point %s could not be located in the dynamic link library %s
-      - string: The ordinal %u could not be located in the dynamic link library %s
+      - string: "The procedure entry point %s could not be located in the dynamic link library %s"
+      - string: "The ordinal %u could not be located in the dynamic link library %s"
diff --git a/anti-analysis/packer/confuser/packed-with-confuser.yml b/anti-analysis/packer/confuser/packed-with-confuser.yml
index 78fac117..59e8323b 100644
--- a/anti-analysis/packer/confuser/packed-with-confuser.yml
+++ b/anti-analysis/packer/confuser/packed-with-confuser.yml
@@ -12,4 +12,4 @@ rule:
       - b9f5bd514485fb06da39beff051b9fdc
   features:
     - or:
-      - string: ConfusedByAttribute
+      - string: "ConfusedByAttribute"
diff --git a/anti-analysis/packer/upack/packed-with-upack.yml b/anti-analysis/packer/upack/packed-with-upack.yml
index a1b30142..a2d938b3 100644
--- a/anti-analysis/packer/upack/packed-with-upack.yml
+++ b/anti-analysis/packer/upack/packed-with-upack.yml
@@ -16,4 +16,4 @@ rule:
     - or:
       - section: .Upack
       - section: .ByDwing
-      - string: UpackByDwing@
+      - string: "UpackByDwing@"
diff --git a/anti-analysis/packer/vmprotect/packed-with-vmprotect.yml b/anti-analysis/packer/vmprotect/packed-with-vmprotect.yml
index 59770b5f..ab81eb6f 100644
--- a/anti-analysis/packer/vmprotect/packed-with-vmprotect.yml
+++ b/anti-analysis/packer/vmprotect/packed-with-vmprotect.yml
@@ -15,10 +15,10 @@ rule:
       - 971e599e6e707349eccea2fd4c8e5f67
   features:
     - or:
-      - string: A debugger has been found running in your system.
-      - string: Please, unload it from memory and restart your program.
-      - string: File corrupted!. This program has been manipulated and maybe
-      - string: it's infected by a Virus or cracked. This file won't work anymore.
+      - string: "A debugger has been found running in your system."
+      - string: "Please, unload it from memory and restart your program."
+      - string: "File corrupted!. This program has been manipulated and maybe"
+      - string: "it's infected by a Virus or cracked. This file won't work anymore."
       - section: .vmp0
       - section: .vmp1
       - section: .vmp2
diff --git a/c2/shell/execute-shell-command-and-capture-output.yml b/c2/shell/execute-shell-command-and-capture-output.yml
index 760f97a6..2767143d 100644
--- a/c2/shell/execute-shell-command-and-capture-output.yml
+++ b/c2/shell/execute-shell-command-and-capture-output.yml
@@ -16,10 +16,10 @@ rule:
       - match: create pipe
       - or:
         - match: get COMSPEC environment variable
-        - string: \\cmd.exe
-        - string: cmd.exe
-        - string: 'cmd.exe /c '
-        - string: C:\\Windows\\system32\\cmd.exe
+        - string: "\\cmd.exe"
+        - string: "cmd.exe"
+        - string: "cmd.exe /c "
+        - string: "C:\\Windows\\system32\\cmd.exe"
       - optional:
         - api: kernel32.GetSystemDirectory
         - api: kernel32.SetCurrentDirectory
diff --git a/collection/browser/gather-firefox-profile-information.yml b/collection/browser/gather-firefox-profile-information.yml
index 53d6f7e8..48cac094 100644
--- a/collection/browser/gather-firefox-profile-information.yml
+++ b/collection/browser/gather-firefox-profile-information.yml
@@ -17,13 +17,13 @@ rule:
       - string: /WHERE moz_cookies.host LIKE/
       - optional:
         - or:
-          - string: encryptedUsername
-          - string: encryptedPassword
-          - string: usernameField
-          - string: formSubmitURL
-          - string: httpRealm
-          - string: passwordField
-          - string: timeCreated
-          - string: timeLastUsed
-          - string: timePasswordChanged
-          - string: timesUsed
+          - string: "encryptedUsername"
+          - string: "encryptedPassword"
+          - string: "usernameField"
+          - string: "formSubmitURL"
+          - string: "httpRealm"
+          - string: "passwordField"
+          - string: "timeCreated"
+          - string: "timeLastUsed"
+          - string: "timePasswordChanged"
+          - string: "timesUsed"
diff --git a/collection/network/capture-network-configuration-via-ipconfig.yml b/collection/network/capture-network-configuration-via-ipconfig.yml
index 09211d6b..c60947bc 100644
--- a/collection/network/capture-network-configuration-via-ipconfig.yml
+++ b/collection/network/capture-network-configuration-via-ipconfig.yml
@@ -14,6 +14,6 @@ rule:
       - api: msvcr100.system
       - optional:
         - and:
-          - string: ipconfig.txt
+          - string: "ipconfig.txt"
           - string: /\[Windows IP Configuration\]/
             description: Arkei Stealer Filename and Banner
diff --git a/collection/network/get-mac-address.yml b/collection/network/get-mac-address.yml
index f7655385..961554a0 100644
--- a/collection/network/get-mac-address.yml
+++ b/collection/network/get-mac-address.yml
@@ -19,4 +19,4 @@ rule:
         - offset: 0x198 = IP_ADAPTER_INFO.Address+4
         - offset: 0x199 = IP_ADAPTER_INFO.Address+5
       - optional:
-        - string: '%02X-%02X-%02X-%02X-%02X-%02X'
+        - string: "%02X-%02X-%02X-%02X-%02X-%02X"
diff --git a/collection/screenshot/capture-screenshot.yml b/collection/screenshot/capture-screenshot.yml
index 357195d5..2e55742f 100644
--- a/collection/screenshot/capture-screenshot.yml
+++ b/collection/screenshot/capture-screenshot.yml
@@ -23,7 +23,7 @@ rule:
           - api: user32.GetDC
           - and:
             - api: gdi32.CreateDCA
-            - string: DISPLAY
+            - string: "DISPLAY"
         - or:
           - api: gdi32.BitBlt
           - api: gdi32.GetDIBits
diff --git a/compiler/autoit/compiled-with-autoit.yml b/compiler/autoit/compiled-with-autoit.yml
index 9d757635..f070ea94 100644
--- a/compiler/autoit/compiled-with-autoit.yml
+++ b/compiler/autoit/compiled-with-autoit.yml
@@ -12,8 +12,8 @@ rule:
     - or:
       # strings from: https://fumik0.com/2019/03/25/lets-play-with-qulab-an-exotic-malware-developed-in-autoit/
       - string: "AutoIt has detected the stack has become corrupt.\n\nStack corruption typically occurs when either the wrong calling convention is used or when the function is called with the wrong number of arguments.\n\nAutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions.  The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead.  See the DllCall() documentation for details on changing the calling convention."
-      - string: AutoIt Error
+      - string: "AutoIt Error"
       - string: />>>AUTOIT SCRIPT<<</
-      - string: '>>>AUTOIT NO CMDEXECUTE<<<'
-      - string: '#requireadmin'
-      - string: '#OnAutoItStartRegister'
+      - string: ">>>AUTOIT NO CMDEXECUTE<<<"
+      - string: "#requireadmin"
+      - string: "#OnAutoItStartRegister"
diff --git a/compiler/delphi/compiled-with-borland-delphi.yml b/compiler/delphi/compiled-with-borland-delphi.yml
index d19c060d..58df7752 100644
--- a/compiler/delphi/compiled-with-borland-delphi.yml
+++ b/compiler/delphi/compiled-with-borland-delphi.yml
@@ -8,8 +8,8 @@ rule:
       - 4BDD67FF852C221112337FECD0681EAC
   features:
     - or:
-      - string: Borland C++ - Copyright 2002 Borland Corporation
+      - string: "Borland C++ - Copyright 2002 Borland Corporation"
       - string: /SOFTWARE\\Borland\\Delphi\\RTL/
-      - string: Sysutils::Exception
-      - string: TForm1
-      - import: BORLNDMM.DLL
+      - string: "Sysutils::Exception"
+      - string: "TForm1"
+      - import: "BORLNDMM.DLL"
diff --git a/compiler/exe4j/compiled-with-exe4j.yml b/compiler/exe4j/compiled-with-exe4j.yml
index 23d7720f..33561761 100644
--- a/compiler/exe4j/compiled-with-exe4j.yml
+++ b/compiler/exe4j/compiled-with-exe4j.yml
@@ -8,15 +8,15 @@ rule:
       - 6b25f1e754ef486bbb28a66d46bababe:0x404EDE
   features:
     - or:
-      - string: exe4j_log
-      - string: install4j_log
-      - string: exe4j_java_home
-      - string: install4j
-      - string: exe4j.isinstall4j
+      - string: "exe4j_log"
+      - string: "install4j_log"
+      - string: "exe4j_java_home"
+      - string: "install4j"
+      - string: "exe4j.isinstall4j"
       - string: /com/exe4j/runtime/exe4jcontroller/i
       - string: /com/exe4j/runtime/winlauncher/i
-      - string: EXE4J_LOG
-      - string: INSTALL4J_LOG
-      - string: EXE4J_JAVA_HOME
-      - string: INSTALL4J
-      - string: EXE4J.ISINSTALL4J
+      - string: "EXE4J_LOG"
+      - string: "INSTALL4J_LOG"
+      - string: "EXE4J_JAVA_HOME"
+      - string: "INSTALL4J"
+      - string: "EXE4J.ISINSTALL4J"
diff --git a/compiler/mingw/compiled-with-mingw-for-windows.yml b/compiler/mingw/compiled-with-mingw-for-windows.yml
index 14bad7b1..f1d56ed1 100644
--- a/compiler/mingw/compiled-with-mingw-for-windows.yml
+++ b/compiler/mingw/compiled-with-mingw-for-windows.yml
@@ -8,5 +8,5 @@ rule:
       - 5b3968b47eb16a1cb88525e3b565eab1
   features:
     - and:
-      - string: 'Mingw runtime failure:'
-      - string: _Jv_RegisterClasses  # from GCC
+      - string: "Mingw runtime failure:"
+      - string: "_Jv_RegisterClasses"  # from GCC
diff --git a/compiler/perl2exe/compiled-with-perl2exe.yml b/compiler/perl2exe/compiled-with-perl2exe.yml
index 0c429e34..baff5c74 100644
--- a/compiler/perl2exe/compiled-with-perl2exe.yml
+++ b/compiler/perl2exe/compiled-with-perl2exe.yml
@@ -14,4 +14,4 @@ rule:
       - basic block:
         - and:
           - api: GetProcAddress
-          - string: RunPerl
+          - string: "RunPerl"
diff --git a/compiler/ps2exe/compiled-with-ps2exe.yml b/compiler/ps2exe/compiled-with-ps2exe.yml
index 2f57f2c8..37a8c595 100644
--- a/compiler/ps2exe/compiled-with-ps2exe.yml
+++ b/compiler/ps2exe/compiled-with-ps2exe.yml
@@ -11,6 +11,6 @@ rule:
   features:
     - and:
       - match: compiled to the .NET platform
-      - string: PS2EXEApp
-      - string: PS2EXE
-      - string: PS2EXE_Host
+      - string: "PS2EXEApp"
+      - string: "PS2EXE"
+      - string: "PS2EXE_Host"
diff --git a/compiler/py2exe/compiled-with-py2exe.yml b/compiler/py2exe/compiled-with-py2exe.yml
index 2745a90d..ec59faf6 100644
--- a/compiler/py2exe/compiled-with-py2exe.yml
+++ b/compiler/py2exe/compiled-with-py2exe.yml
@@ -8,5 +8,5 @@ rule:
       - ed888dc2f04f5eac83d6d14088d002de:0x40194A
   features:
     - and:
-      - string: PY2EXE_VERBOSE
+      - string: "PY2EXE_VERBOSE"
       - api: getenv
diff --git a/compiler/pyarmor/compiled-with-pyarmor.yml b/compiler/pyarmor/compiled-with-pyarmor.yml
index 42da5cdf..a1e76a2e 100644
--- a/compiler/pyarmor/compiled-with-pyarmor.yml
+++ b/compiler/pyarmor/compiled-with-pyarmor.yml
@@ -12,7 +12,7 @@ rule:
       - a0fb20bc9aa944c3a0a6c4545c195818
   features:
     - or:
-      - string: pyarmor_runtimesh
-      - string: PYARMOR
-      - string: __pyarmor__
-      - string: PYARMOR_SIGNATURE
+      - string: "pyarmor_runtimesh"
+      - string: "PYARMOR"
+      - string: "__pyarmor__"
+      - string: "PYARMOR_SIGNATURE"
diff --git a/data-manipulation/compression/compress-data-via-winapi.yml b/data-manipulation/compression/compress-data-via-winapi.yml
index 49c21651..079f0868 100644
--- a/data-manipulation/compression/compress-data-via-winapi.yml
+++ b/data-manipulation/compression/compress-data-via-winapi.yml
@@ -15,16 +15,16 @@ rule:
       # these APIs are not typically intended for user mode programs.
       # they're only accessible via GetProcAddress on ntoskrnl/ntdll.
       - api: RtlDecompressBuffer
-      - string: RtlDecompressBuffer
+      - string: "RtlDecompressBuffer"
 
       - api: RtlDecompressBufferEx
-      - string: RtlDecompressBufferEx
+      - string: "RtlDecompressBufferEx"
 
       - api: RtlDecompressBufferEx2
-      - string: RtlDecompressBufferEx2
+      - string: "RtlDecompressBufferEx2"
 
       - api: RtlCompressBuffer
-      - string: RtlCompressBuffer
+      - string: "RtlCompressBuffer"
 
       - api: RtlCompressBufferLZNT1
-      - string: RtlCompressBufferLZNT1
+      - string: "RtlCompressBufferLZNT1"
diff --git a/data-manipulation/encoding/base64/encode-data-using-base64.yml b/data-manipulation/encoding/base64/encode-data-using-base64.yml
index 3179b9ae..e51adbc9 100644
--- a/data-manipulation/encoding/base64/encode-data-using-base64.yml
+++ b/data-manipulation/encoding/base64/encode-data-using-base64.yml
@@ -29,4 +29,4 @@ rule:
         - number: 4
         - number: 6
         - number: 0xF
-        - string: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
+        - string: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
diff --git a/data-manipulation/encryption/aes/encrypt-data-using-aes-via-net.yml b/data-manipulation/encryption/aes/encrypt-data-using-aes-via-net.yml
index be85f00e..7ec4471f 100644
--- a/data-manipulation/encryption/aes/encrypt-data-using-aes-via-net.yml
+++ b/data-manipulation/encryption/aes/encrypt-data-using-aes-via-net.yml
@@ -13,6 +13,6 @@ rule:
       - b9f5bd514485fb06da39beff051b9fdc
   features:
     - and:
-      - string: RijndaelManaged
-      - string: CryptoStream
-      - string: System.Security.Cryptography
+      - string: "RijndaelManaged"
+      - string: "CryptoStream"
+      - string: "System.Security.Cryptography"
diff --git a/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml b/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml
index 55ba5c48..a6e0755c 100644
--- a/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml
+++ b/data-manipulation/encryption/camellia/encrypt-data-using-camellia.yml
@@ -43,7 +43,7 @@ rule:
         - and:
           - string: /A09E667F3BCC908B/i
             description: sigma1_str
-          - string: /B67AE8584CAA73B
+          - string: "/B67AE8584CAA73B"
             description: sigma2_str
           - string: /C6EF372FE94F82BE/i
             description: sigma3_str
diff --git a/doc/format.md b/doc/format.md
index 88547518..27a289ee 100644
--- a/doc/format.md
+++ b/doc/format.md
@@ -316,7 +316,15 @@ This is probably a pointer to an ASCII or Unicode string.
 This could also be an obfuscated string, for example a stack string.
 
 The parameter is a string describing the string.
-This can be the verbatim value, or a regex matching the string.
+This can be the verbatim value or a regex matching the string.
+
+Verbatim values should be surrounded by double quotes and special characters should be escaped.
+
+A special character is one of:
+  - a backslash, which should be represented as `string: "\\"`
+  - a newline or other non-space whitespace (e.g. tab, CR, LF, etc), which should be represented like `string: "\n"`
+  - a double quote, which should be represented as `string: "\""`
+
 Regexes should be surrounded with `/` characters. 
 By default, capa uses case-sensitive matching and assumes leading and trailing wildcards.
 To perform case-insensitive matching append an `i`. To anchor the regex at the start or end of a string, use `^` and/or `$`.
@@ -327,12 +335,13 @@ See the [description section](#descriptions) for more details.
 Examples:
 
 ```
-- string: Firefox 64.0
-- string: This program cannot be run in DOS mode.
+- string: "Firefox 64.0"
+- string: "Hostname:\t\t\t%s\nIP adress:\t\t\t%s\nOS version:\t\t\t%s\n"
+- string: "This program cannot be run in DOS mode."
   description: MS-DOS stub message
-- string: '{3E5FC7F9-9A51-4367-9063-A120244FBEC7}'
+- string: "{3E5FC7F9-9A51-4367-9063-A120244FBEC7}"
   description: CLSID_CMSTPLUA
-- string: '/SELECT.*FROM.*WHERE/'
+- string: /SELECT.*FROM.*WHERE/
   description: SQL WHERE Clause
 - string: /Hardware\\Description\\System\\CentralProcessor/i
 ```
@@ -435,13 +444,21 @@ An ASCII or UTF-16 LE string present in the file.
 
 The parameter is a string describing the string.
 This can be the verbatim value, or a regex matching the string.
+
+Verbatim values should be surrounded by double quotes and special characters should be escaped.
+
+A special character is one of:
+  - a backslash, which should be represented as `string: "\\"`
+  - a newline or other non-space whitespace (e.g. tab, CR, LF, etc), which should be represented like `string: "\n"`
+  - a double quote, which should be represented as `string: "\""`
+
 Regexes should be surrounded with `/` characters. By default, capa uses case-sensitive matching.
 To perform case-insensitive matching append an `i`.
 
 Examples:
 
-    string: Z:\Dev\dropper\dropper.pdb
-    string: [ENTER]
+    string: "Z:\Dev\dropper\dropper.pdb"
+    string: "[ENTER]"
     string: /.*VBox.*/
     string: /.*Software\Microsoft\Windows\CurrentVersion\Run.*/i
 
@@ -535,7 +552,7 @@ For example:
 
 ```
 - or:
-  - string: This program cannot be run in DOS mode.
+  - string: "This program cannot be run in DOS mode."
     description: MS-DOS stub message
   - number: 0x5A4D
     description: IMAGE_DOS_SIGNATURE (MZ)
diff --git a/executable/installer/iexpress/packaged-as-an-iexpress-self-extracting-archive.yml b/executable/installer/iexpress/packaged-as-an-iexpress-self-extracting-archive.yml
index 66d1262f..e6c5d4ca 100644
--- a/executable/installer/iexpress/packaged-as-an-iexpress-self-extracting-archive.yml
+++ b/executable/installer/iexpress/packaged-as-an-iexpress-self-extracting-archive.yml
@@ -13,6 +13,6 @@ rule:
   features:
     - or:
       - and:
-        - string: wextract_cleanup%d
-        - string: Software\Microsoft\Windows\CurrentVersion\RunOnce
-      - string: '  <description>IExpress extraction tool</description>'
+        - string: "wextract_cleanup%d"
+        - string: "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce"
+      - string: "  <description>IExpress extraction tool</description>"
diff --git a/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml b/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml
index 5006b2a7..04bf6523 100644
--- a/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml
+++ b/host-interaction/file-system/windows-file-protection/bypass-windows-file-protection.yml
@@ -10,6 +10,6 @@ rule:
       - Practical Malware Analysis Lab 01-04.exe_:0x401174
   features:
     - and:
-      - string: sfc_os.dll              #   System File Checker
+      - string: "sfc_os.dll"              #   System File Checker
       - number: 0x2                     #   SfcTerminateWatcherThread
       - match: link function at runtime
diff --git a/host-interaction/gui/taskbar/find/find-taskbar.yml b/host-interaction/gui/taskbar/find/find-taskbar.yml
index e58c8835..dcc7ae9c 100644
--- a/host-interaction/gui/taskbar/find/find-taskbar.yml
+++ b/host-interaction/gui/taskbar/find/find-taskbar.yml
@@ -10,5 +10,5 @@ rule:
       - B7841B9D5DC1F511A93CC7576672EC0C:0x10007250
   features:
     - and:
-      - string: Shell_TrayWnd
+      - string: "Shell_TrayWnd"
       - match: find graphical window
diff --git a/host-interaction/hardware/cdrom/manipulate-cd-rom-drive.yml b/host-interaction/hardware/cdrom/manipulate-cd-rom-drive.yml
index cf7474f7..7841b24f 100644
--- a/host-interaction/hardware/cdrom/manipulate-cd-rom-drive.yml
+++ b/host-interaction/hardware/cdrom/manipulate-cd-rom-drive.yml
@@ -12,5 +12,5 @@ rule:
     - and:
       - api: winmm.mciSendString
       - or:
-        - string: set cdaudio door closed wait
-        - string: set cdaudio door open
+        - string: "set cdaudio door closed wait"
+        - string: "set cdaudio door open"
diff --git a/host-interaction/hardware/cpu/get-number-of-processor-cores.yml b/host-interaction/hardware/cpu/get-number-of-processor-cores.yml
index 6c0571ef..93798194 100644
--- a/host-interaction/hardware/cpu/get-number-of-processor-cores.yml
+++ b/host-interaction/hardware/cpu/get-number-of-processor-cores.yml
@@ -13,4 +13,4 @@ rule:
   features:
     - and:
       - string: /SELECT\s+\*\s+FROM\s+Win32_Processor/
-      - string: NumberOfCores
+      - string: "NumberOfCores"
diff --git a/host-interaction/hardware/keyboard/simulate-ctrl-alt-del.yml b/host-interaction/hardware/keyboard/simulate-ctrl-alt-del.yml
index c06b5ec1..ae288ecb 100644
--- a/host-interaction/hardware/keyboard/simulate-ctrl-alt-del.yml
+++ b/host-interaction/hardware/keyboard/simulate-ctrl-alt-del.yml
@@ -18,7 +18,7 @@ rule:
             - or:
               - api: OpenDesktop
               - api: OpenInputDesktop
-            - string: Winlogon
+            - string: "Winlogon"
       - basic block:
         - and:
           - api: PostMessage
diff --git a/host-interaction/hardware/storage/get-disk-size.yml b/host-interaction/hardware/storage/get-disk-size.yml
index 19ad3a54..04587f2d 100644
--- a/host-interaction/hardware/storage/get-disk-size.yml
+++ b/host-interaction/hardware/storage/get-disk-size.yml
@@ -23,4 +23,4 @@ rule:
         - or:
           - string: /SELECT\s+\*\s+FROM\s+Win32_LogicalDisk/i
           - string: /SELECT\s+\*\s+FROM\s+Win32_DiskDrive\s+WHERE\s+\(SerialNumber\s+IS\s+NOT\s+NULL\)\s+AND\s+\(MediaType\s+LIKE\s+\'Fixed\s+hard\s+disk\%\'\)/i
-        - string: Size
+        - string: "Size"
diff --git a/host-interaction/process/inject/use-process-doppelganging.yml b/host-interaction/process/inject/use-process-doppelganging.yml
index 65a3d94e..70f4602d 100644
--- a/host-interaction/process/inject/use-process-doppelganging.yml
+++ b/host-interaction/process/inject/use-process-doppelganging.yml
@@ -13,6 +13,6 @@ rule:
     - and:
       - string: /CreateFileTransacted./
       - or:
-        - string: ZwCreateSection
-        - string: NtCreateSection
-      - string: RollbackTransaction
+        - string: "ZwCreateSection"
+        - string: "NtCreateSection"
+      - string: "RollbackTransaction"
diff --git a/host-interaction/uac/bypass/bypass-uac-via-appinfo-alpc.yml b/host-interaction/uac/bypass/bypass-uac-via-appinfo-alpc.yml
index 5d115d05..21fbe3b4 100644
--- a/host-interaction/uac/bypass/bypass-uac-via-appinfo-alpc.yml
+++ b/host-interaction/uac/bypass/bypass-uac-via-appinfo-alpc.yml
@@ -12,9 +12,9 @@ rule:
       - 2f43138aa75fb12ac482b486cbc98569:0x180002304
   features:
     - and:
-      - string: winver.exe
-      - string: WinSta0\Default
-      - string: taskmgr.exe
+      - string: "winver.exe"
+      - string: "WinSta0\\Default"
+      - string: "taskmgr.exe"
       - api: WaitForDebugEvent
       - api: ContinueDebugEvent
       - api: TerminateProcess
diff --git a/host-interaction/uac/bypass/bypass-uac-via-token-manipulation.yml b/host-interaction/uac/bypass/bypass-uac-via-token-manipulation.yml
index 20d2d48e..59f99907 100644
--- a/host-interaction/uac/bypass/bypass-uac-via-token-manipulation.yml
+++ b/host-interaction/uac/bypass/bypass-uac-via-token-manipulation.yml
@@ -12,7 +12,7 @@ rule:
       - 2f43138aa75fb12ac482b486cbc98569:0x180001B48
   features:
     - and:
-      - string: wusa.exe
+      - string: "wusa.exe"
       - api: ShellExecuteExW
       - api: ImpersonateLoggedOnUser
       - api: GetStartupInfoW
diff --git a/impact/wipe-disk/wipe-mbr/overwrite-master-boot-record-mbr.yml b/impact/wipe-disk/wipe-mbr/overwrite-master-boot-record-mbr.yml
index d9ec2248..dbe102cd 100644
--- a/impact/wipe-disk/wipe-mbr/overwrite-master-boot-record-mbr.yml
+++ b/impact/wipe-disk/wipe-mbr/overwrite-master-boot-record-mbr.yml
@@ -10,7 +10,7 @@ rule:
       - 39C05B15E9834AC93F206BC114D0A00C357C888DB567BA8F5345DA0529CBED41:0x100070A0
   features:
     - and:
-      - string: \\.\PHYSICALDRIVE0
+      - string: "\\\\.\\PHYSICALDRIVE0"
       - api: kernel32.WriteFile
       # MBR/sector size in bytes
       - number: 0x200
diff --git a/linking/static/cryptopp/linked-against-crypto.yml b/linking/static/cryptopp/linked-against-crypto.yml
index 98fba18b..21f0b016 100644
--- a/linking/static/cryptopp/linked-against-crypto.yml
+++ b/linking/static/cryptopp/linked-against-crypto.yml
@@ -11,9 +11,9 @@ rule:
       - 66602B5FAB602CB4E6F754748D249542
   features:
     - or:
-      - string: Cryptographic algorithms are disabled after a power-up self test failed.
-      - string: ': this object requires an IV'
-      - string: BER decode error
-      - string: .?AVException@CryptoPP@@
-      - string: 'FileStore: error reading file'
-      - string: 'StreamTransformationFilter: PKCS_PADDING cannot be used with '
+      - string: "Cryptographic algorithms are disabled after a power-up self test failed."
+      - string: ": this object requires an IV"
+      - string: "BER decode error"
+      - string: ".?AVException@CryptoPP@@"
+      - string: "FileStore: error reading file"
+      - string: "StreamTransformationFilter: PKCS_PADDING cannot be used with "
diff --git a/linking/static/openssl/linked-against-openssl.yml b/linking/static/openssl/linked-against-openssl.yml
index e177e27e..da06d549 100644
--- a/linking/static/openssl/linked-against-openssl.yml
+++ b/linking/static/openssl/linked-against-openssl.yml
@@ -10,6 +10,6 @@ rule:
       - 6cc148363200798a12091b97a17181a1
   features:
     - or:
-      - string: RC4 for x86_64, CRYPTOGAMS by <appro@openssl.org>
-      - string: AES for x86_64, CRYPTOGAMS by <appro@openssl.org>
-      - string: DSA-SHA1-old
+      - string: "RC4 for x86_64, CRYPTOGAMS by <appro@openssl.org>"
+      - string: "AES for x86_64, CRYPTOGAMS by <appro@openssl.org>"
+      - string: "DSA-SHA1-old"
diff --git a/linking/static/polarssl/linked-against-polarsslmbed-tls.yml b/linking/static/polarssl/linked-against-polarsslmbed-tls.yml
index 535d0aac..9f227207 100644
--- a/linking/static/polarssl/linked-against-polarsslmbed-tls.yml
+++ b/linking/static/polarssl/linked-against-polarsslmbed-tls.yml
@@ -10,8 +10,8 @@ rule:
       - 232b0a8546035d9017fadf68398826edb0a1e055566bc1d356d6c9fdf1d7e485
   features:
     - or:
-      - string: PolarSSLTest
-      - string: mbedtls_cipher_setup
-      - string: mbedtls_pk_verify
-      - string: mbedtls_ssl_write_record
-      - string: mbedtls_ssl_fetch_input
+      - string: "PolarSSLTest"
+      - string: "mbedtls_cipher_setup"
+      - string: "mbedtls_pk_verify"
+      - string: "mbedtls_ssl_write_record"
+      - string: "mbedtls_ssl_fetch_input"
diff --git a/nursery/bypass-uac-via-icmluautil.yml b/nursery/bypass-uac-via-icmluautil.yml
index acb36db0..a740c4a1 100644
--- a/nursery/bypass-uac-via-icmluautil.yml
+++ b/nursery/bypass-uac-via-icmluautil.yml
@@ -11,12 +11,12 @@ rule:
   features:
     - and:
       - or:
-        - string: '{3E5FC7F9-9A51-4367-9063-A120244FBEC7}' # T_CLSID_CMSTPLUA
+        - string: "{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" # T_CLSID_CMSTPLUA
         - bytes: F9 C7 5F 3E 51 9A 67 43 90 63 A1 20 24 4F BE C7 = T_CLSID_CMSTPLUA
-      - string: '{3E5FC7F9-9A51-4367-9063-A120244FBEC7}' # T_CLSID_CMSTPLUA
+      - string: "{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" # T_CLSID_CMSTPLUA
       - optional:
         - or:
           - api: ole32.CoGetObject
           - or:
-            - string: '{6EDD6D74-C007-4E75-B76A-E5740995E24C}' # IID_ICMLuaUtil
+            - string: "{6EDD6D74-C007-4E75-B76A-E5740995E24C}" # IID_ICMLuaUtil
             - bytes: 74 6D DD 6E 07 C0 75 4E B7 6A E5 74 09 95 E2 4C = IID_ICMLuaUtil
diff --git a/nursery/bypass-uac-via-scheduled-task-environment-variable.yml b/nursery/bypass-uac-via-scheduled-task-environment-variable.yml
index 1414788d..b1eff14d 100644
--- a/nursery/bypass-uac-via-scheduled-task-environment-variable.yml
+++ b/nursery/bypass-uac-via-scheduled-task-environment-variable.yml
@@ -11,11 +11,11 @@ rule:
       - https://enigma0x3.net/2016/07/22/bypassing-uac-on-windows-10-using-disk-cleanup
   features:
     - and:
-      - string: schtasks.exe
+      - string: "schtasks.exe"
       - string: /Microsoft\\Windows\\DiskCleanup\\SilentCleanup/i
       - match: create process
       - optional:
         - or:
-          - string: Environment
-          - string: windir
+          - string: "Environment"
+          - string: "windir"
           - match: set registry value
diff --git a/nursery/capture-screenshot-in-go.yml b/nursery/capture-screenshot-in-go.yml
index a015399f..c68aa780 100644
--- a/nursery/capture-screenshot-in-go.yml
+++ b/nursery/capture-screenshot-in-go.yml
@@ -15,7 +15,7 @@ rule:
       - match: compiled with Go
       - or:
         - and:
-          - string: syscall.NewLazyDLL
+          - string: "syscall.NewLazyDLL"
             description: Dynamic loading of DLLs
           - or:
             - and:
diff --git a/nursery/check-for-windows-sandbox-via-mutex.yml b/nursery/check-for-windows-sandbox-via-mutex.yml
index 2f4396ba..fbd085f7 100644
--- a/nursery/check-for-windows-sandbox-via-mutex.yml
+++ b/nursery/check-for-windows-sandbox-via-mutex.yml
@@ -13,4 +13,4 @@ rule:
   features:
     - and:
       - match: check mutex
-      - string: WindowsSandboxMutex
+      - string: "WindowsSandboxMutex"
diff --git a/nursery/check-license-value.yml b/nursery/check-license-value.yml
index d59d550a..01f32b35 100644
--- a/nursery/check-license-value.yml
+++ b/nursery/check-license-value.yml
@@ -11,4 +11,4 @@ rule:
   features:
     - and:
       - api: NtQueryLicenseValue
-      - string: Kernel-VMDetection-Private
+      - string: "Kernel-VMDetection-Private"
diff --git a/nursery/debug-build.yml b/nursery/debug-build.yml
index 49d05d9b..107d41b4 100644
--- a/nursery/debug-build.yml
+++ b/nursery/debug-build.yml
@@ -6,5 +6,5 @@ rule:
     scope: file
   features:
     - or:
-      - string: Assertion failed!
-      - string: 'Assertion failed:'
+      - string: "Assertion failed!"
+      - string: "Assertion failed:"
diff --git a/nursery/encrypt-data-using-salsa20-or-chacha.yml b/nursery/encrypt-data-using-salsa20-or-chacha.yml
index 9a00a22a..382b0719 100644
--- a/nursery/encrypt-data-using-salsa20-or-chacha.yml
+++ b/nursery/encrypt-data-using-salsa20-or-chacha.yml
@@ -12,15 +12,15 @@ rule:
     # The constant words spell "expand 32-byte k" in ASCII (i.e. the 4 words are "expa", "nd 3", "2-by", and "te k")
     - or:
       - description: part of key setup
-      - string: expand 32-byte k = sigma
-      - string: expand 16-byte k = tau
+      - string: "expand 32-byte k = sigma"
+      - string: "expand 16-byte k = tau"
       # if sigma and tau are in contiguous memory, may result in concatenated string
-      - string: expand 32-byte kexpand 16-byte k
+      - string: "expand 32-byte kexpand 16-byte k"
       - and:
-        - string: expa
-        - string: nd 3
-        - string: 2-by
-        - string: te k
+        - string: "expa"
+        - string: "nd 3"
+        - string: "2-by"
+        - string: "te k"
       - and:
         - number: 0x61707865  # apxe
         - number: 0x3320646E  # 3 dn
diff --git a/nursery/get-client-handle-via-schannel.yml b/nursery/get-client-handle-via-schannel.yml
index b0571892..1ceba697 100644
--- a/nursery/get-client-handle-via-schannel.yml
+++ b/nursery/get-client-handle-via-schannel.yml
@@ -15,4 +15,4 @@ rule:
       - match: get outbound credentials handle via CredSSP
       - number: 4 = CredsspSchannelCreds
       - optional:
-        - string: Microsoft Unified Security Protocol Provider
+        - string: "Microsoft Unified Security Protocol Provider"
diff --git a/nursery/get-comspec-environment-variable.yml b/nursery/get-comspec-environment-variable.yml
index 0d880e19..7da96777 100644
--- a/nursery/get-comspec-environment-variable.yml
+++ b/nursery/get-comspec-environment-variable.yml
@@ -8,5 +8,5 @@ rule:
     - and:
       - match: query environment variable
       - or:
-        - string: COMSPEC
-        - string: '%COMSPEC%'
+        - string: "COMSPEC"
+        - string: "%COMSPEC%"
diff --git a/nursery/get-proxy.yml b/nursery/get-proxy.yml
index 60a90bae..916b924b 100644
--- a/nursery/get-proxy.yml
+++ b/nursery/get-proxy.yml
@@ -9,4 +9,4 @@ rule:
   features:
     - and:
       - match: create or open registry key
-      - string: ProxyServer
+      - string: "ProxyServer"
diff --git a/nursery/linked-against-c-regex-library.yml b/nursery/linked-against-c-regex-library.yml
index 7b6e1757..5f315fb3 100644
--- a/nursery/linked-against-c-regex-library.yml
+++ b/nursery/linked-against-c-regex-library.yml
@@ -6,5 +6,5 @@ rule:
     scope: file
   features:
     - or:
-      - string: regex_error(error_syntax)    # from C++ STL regex, ref: http://www.cplusplus.com/reference/regex/regex_error/
-      - string: 'regex_error(error_collate): The expression contained an invalid collating element name.'
+      - string: "regex_error(error_syntax)"    # from C++ STL regex, ref: http://www.cplusplus.com/reference/regex/regex_error/
+      - string: "regex_error(error_collate): The expression contained an invalid collating element name."
diff --git a/nursery/linked-against-go-process-enumeration-library.yml b/nursery/linked-against-go-process-enumeration-library.yml
index 0782dfa4..ab8c5eab 100644
--- a/nursery/linked-against-go-process-enumeration-library.yml
+++ b/nursery/linked-against-go-process-enumeration-library.yml
@@ -16,5 +16,5 @@ rule:
       - match: compiled with Go
       - or:
         - or:
-          - string: github.com/mitchellh/go-ps.FindProcess
-          - string: github.com/mitchellh/go-ps.Processes
+          - string: "github.com/mitchellh/go-ps.FindProcess"
+          - string: "github.com/mitchellh/go-ps.Processes"
diff --git a/nursery/linked-against-go-registry-library.yml b/nursery/linked-against-go-registry-library.yml
index b29c5e1c..cd911c82 100644
--- a/nursery/linked-against-go-registry-library.yml
+++ b/nursery/linked-against-go-registry-library.yml
@@ -12,5 +12,5 @@ rule:
     - and:
       - match: compiled with Go
       - or:
-        - string: golang.org/x/sys/windows/registry.Key.Close
-        - string: github.com/golang/sys/windows/registry.Key.Close
+        - string: "golang.org/x/sys/windows/registry.Key.Close"
+        - string: "github.com/golang/sys/windows/registry.Key.Close"
diff --git a/nursery/linked-against-go-static-asset-library.yml b/nursery/linked-against-go-static-asset-library.yml
index 50d1204b..d4767ea2 100644
--- a/nursery/linked-against-go-static-asset-library.yml
+++ b/nursery/linked-against-go-static-asset-library.yml
@@ -21,26 +21,26 @@ rule:
       - match: compiled with Go
       - or:
         - or:
-          - string: github.com/rakyll/statik/fs.IsDefaultNamespace
-          - string: github.com/rakyll/statik/fs.RegisterWithNamespace
-          - string: github.com/rakyll/statik/fs.NewWithNamespace
-          - string: github.com/rakyll/statik/fs.Register
+          - string: "github.com/rakyll/statik/fs.IsDefaultNamespace"
+          - string: "github.com/rakyll/statik/fs.RegisterWithNamespace"
+          - string: "github.com/rakyll/statik/fs.NewWithNamespace"
+          - string: "github.com/rakyll/statik/fs.Register"
         - and:
-          - string: github.com/gobuffalo/packr.NewBox
+          - string: "github.com/gobuffalo/packr.NewBox"
         - or:
-          - string: github.com/markbates/pkger.Open
-          - string: github.com/markbates/pkger.Include
-          - string: github.com/markbates/pkger.Parse
+          - string: "github.com/markbates/pkger.Open"
+          - string: "github.com/markbates/pkger.Include"
+          - string: "github.com/markbates/pkger.Parse"
         - or:
-          - string: github.com/GeertJohan/go.rice.FindBox
-          - string: github.com/GeertJohan/go.rice.MustFindBox
+          - string: "github.com/GeertJohan/go.rice.FindBox"
+          - string: "github.com/GeertJohan/go.rice.MustFindBox"
         - and:
-          - string: '/\/bindata\.go/'
+          - string: /\/bindata\.go/
             description: go-bindata
-          - string: '/\.Asset/'
+          - string: /\.Asset/
         - and:
-          - string: github.com/lu4p/binclude.Include
+          - string: "github.com/lu4p/binclude.Include"
         - and:
-          - string: github.com/omeid/go-resources
+          - string: "github.com/omeid/go-resources"
         - and:
-          - string: github.com/pyros2097/go-embed
+          - string: "github.com/pyros2097/go-embed"
diff --git a/nursery/linked-against-go-wmi-library.yml b/nursery/linked-against-go-wmi-library.yml
index 8e04ec6f..3d0e1a2d 100644
--- a/nursery/linked-against-go-wmi-library.yml
+++ b/nursery/linked-against-go-wmi-library.yml
@@ -15,5 +15,5 @@ rule:
       - match: compiled with Go
       - or:
         - or:
-          - string: github.com/StackExchange/wmi.CreateQuery
-          - string: github.com/StackExchange/wmi.Query
+          - string: "github.com/StackExchange/wmi.CreateQuery"
+          - string: "github.com/StackExchange/wmi.Query"
diff --git a/nursery/mine-cryptocurrency.yml b/nursery/mine-cryptocurrency.yml
index 12e8d981..a21cd71f 100644
--- a/nursery/mine-cryptocurrency.yml
+++ b/nursery/mine-cryptocurrency.yml
@@ -10,40 +10,40 @@ rule:
       - https://github.com/ctxis/CAPE/blob/master/modules/signatures/cryptomining.py
   features:
     - or:
-      - string: stratum+tcp://
-      - string: xmrig
-      - string: xmr-stak
-      - string: 'supportxmr.com:'
-      - string: 'dwarfpool.com:'
-      - string: minergate
-      - string: xmr.
-      - string: monero.
-      - string: Bitcoin
-      - string: Bitcoin
-      - string: BitcoinGold
-      - string: BtcCash
-      - string: Ethereum
-      - string: BlackCoin
-      - string: ByteCoin
-      - string: EmerCoin
-      - string: ReddCoin
-      - string: Peercoin
-      - string: Ripple
-      - string: Miota
-      - string: Cardano
-      - string: Lisk
-      - string: Stratis
-      - string: Waves
-      - string: Qtum
-      - string: Stellar
-      - string: ViaCoin
-      - string: Electroneum
-      - string: Dash
-      - string: Doge
-      - string: Monero
-      - string: Graft
-      - string: Zcash
-      - string: Ya.money
-      - string: Ya.disc
-      - string: Steam
-      - string: vk.cc
+      - string: "stratum+tcp://"
+      - string: "xmrig"
+      - string: "xmr-stak"
+      - string: "supportxmr.com:"
+      - string: "dwarfpool.com:"
+      - string: "minergate"
+      - string: "xmr."
+      - string: "monero."
+      - string: "Bitcoin"
+      - string: "Bitcoin"
+      - string: "BitcoinGold"
+      - string: "BtcCash"
+      - string: "Ethereum"
+      - string: "BlackCoin"
+      - string: "ByteCoin"
+      - string: "EmerCoin"
+      - string: "ReddCoin"
+      - string: "Peercoin"
+      - string: "Ripple"
+      - string: "Miota"
+      - string: "Cardano"
+      - string: "Lisk"
+      - string: "Stratis"
+      - string: "Waves"
+      - string: "Qtum"
+      - string: "Stellar"
+      - string: "ViaCoin"
+      - string: "Electroneum"
+      - string: "Dash"
+      - string: "Doge"
+      - string: "Monero"
+      - string: "Graft"
+      - string: "Zcash"
+      - string: "Ya.money"
+      - string: "Ya.disc"
+      - string: "Steam"
+      - string: "vk.cc"
diff --git a/nursery/packaged-as-a-wise-installer.yml b/nursery/packaged-as-a-wise-installer.yml
index 852e36bc..93bbc5c0 100644
--- a/nursery/packaged-as-a-wise-installer.yml
+++ b/nursery/packaged-as-a-wise-installer.yml
@@ -6,5 +6,5 @@ rule:
     scope: file
   features:
     - or:
-      - string: WiseMain
+      - string: "WiseMain"
       - string: /Wise Installation Wizard/
diff --git a/nursery/packaged-as-an-installshield-installer.yml b/nursery/packaged-as-an-installshield-installer.yml
index d8b0de7e..3a994c04 100644
--- a/nursery/packaged-as-an-installshield-installer.yml
+++ b/nursery/packaged-as-an-installshield-installer.yml
@@ -10,4 +10,4 @@ rule:
       # which we want to avoid FP'ing on,
       # so do an exact match for this string.
       # ok to relax if there are counterexamples.
-      - string: InstallShield
+      - string: "InstallShield"
diff --git a/nursery/read-raw-disk-data.yml b/nursery/read-raw-disk-data.yml
index 18e5c6b4..b4de1208 100644
--- a/nursery/read-raw-disk-data.yml
+++ b/nursery/read-raw-disk-data.yml
@@ -6,5 +6,5 @@ rule:
     scope: file
   features:
     - or:
-      - string: \\\\.\\PhysicalDrive0
-      - string: '\\.\C:'
+      - string: "\\\\.\\PhysicalDrive0"
+      - string: "\\\\.\\C:"
diff --git a/nursery/reference-114dns-dns-server.yml b/nursery/reference-114dns-dns-server.yml
index 7dcc5c05..8c579058 100644
--- a/nursery/reference-114dns-dns-server.yml
+++ b/nursery/reference-114dns-dns-server.yml
@@ -11,9 +11,9 @@ rule:
       # - ab57d3c179355bf2bcdb7935483d84d4
   features:
     - or:
-      - string: 114.114.114.114
-      - string: 114.114.115.115
-      - string: 114.114.114.119
-      - string: 114.114.115.119
-      - string: 114.114.114.110
-      - string: 114.114.115.110
+      - string: "114.114.114.114"
+      - string: "114.114.115.115"
+      - string: "114.114.114.119"
+      - string: "114.114.115.119"
+      - string: "114.114.114.110"
+      - string: "114.114.115.110"
diff --git a/nursery/reference-alidns-dns-server.yml b/nursery/reference-alidns-dns-server.yml
index 12e323af..5833b397 100644
--- a/nursery/reference-alidns-dns-server.yml
+++ b/nursery/reference-alidns-dns-server.yml
@@ -10,7 +10,7 @@ rule:
       # - ab57d3c179355bf2bcdb7935483d84d4
   features:
     - or:
-      - string: 223.5.5.5
-      - string: 223.6.6.6
-      - string: 2400:3200::1
-      - string: 2400:3200:baba::1
+      - string: "223.5.5.5"
+      - string: "223.6.6.6"
+      - string: "2400:3200::1"
+      - string: "2400:3200:baba::1"
diff --git a/nursery/reference-cloudflare-dns-server.yml b/nursery/reference-cloudflare-dns-server.yml
index ebea4a16..00becf23 100644
--- a/nursery/reference-cloudflare-dns-server.yml
+++ b/nursery/reference-cloudflare-dns-server.yml
@@ -9,5 +9,5 @@ rule:
     examples:
   features:
     - or:
-      - string: 1.1.1.1
-      - string: 1.0.0.1
+      - string: "1.1.1.1"
+      - string: "1.0.0.1"
diff --git a/nursery/reference-comodo-secure-dns-server.yml b/nursery/reference-comodo-secure-dns-server.yml
index 775d0adc..c3cf6fa2 100644
--- a/nursery/reference-comodo-secure-dns-server.yml
+++ b/nursery/reference-comodo-secure-dns-server.yml
@@ -9,5 +9,5 @@ rule:
     examples:
   features:
     - or:
-      - string: 8.26.56.26
-      - string: 8.20.247.20
+      - string: "8.26.56.26"
+      - string: "8.20.247.20"
diff --git a/nursery/reference-google-public-dns-server.yml b/nursery/reference-google-public-dns-server.yml
index 65e0fa39..a704945c 100644
--- a/nursery/reference-google-public-dns-server.yml
+++ b/nursery/reference-google-public-dns-server.yml
@@ -10,7 +10,7 @@ rule:
     examples:
   features:
     - or:
-      - string: 8.8.8.8
-      - string: 8.8.4.4
-      - string: 2001:4860:4860::8888
-      - string: 2001:4860:4860::8844
+      - string: "8.8.8.8"
+      - string: "8.8.4.4"
+      - string: "2001:4860:4860::8888"
+      - string: "2001:4860:4860::8844"
diff --git a/nursery/reference-hurricane-electric-dns-server.yml b/nursery/reference-hurricane-electric-dns-server.yml
index e123c23c..a15b494c 100644
--- a/nursery/reference-hurricane-electric-dns-server.yml
+++ b/nursery/reference-hurricane-electric-dns-server.yml
@@ -10,13 +10,13 @@ rule:
     examples:
   features:
     - or:
-      - string: 216.218.130.2
+      - string: "216.218.130.2"
         description: ns1.he.net
-      - string: 216.218.131.2
+      - string: "216.218.131.2"
         description: ns2.he.net
-      - string: 216.218.132.2
+      - string: "216.218.132.2"
         description: ns3.he.net
-      - string: 216.66.1.2
+      - string: "216.66.1.2"
         description: ns4.he.net
-      - string: 216.66.80.18
+      - string: "216.66.80.18"
         description: ns5.he.net
diff --git a/nursery/reference-kornet-dns-server.yml b/nursery/reference-kornet-dns-server.yml
index a8f9bfb3..a4aa3ffe 100644
--- a/nursery/reference-kornet-dns-server.yml
+++ b/nursery/reference-kornet-dns-server.yml
@@ -10,5 +10,5 @@ rule:
       # - ab57d3c179355bf2bcdb7935483d84d4
   features:
     - or:
-      - string: 168.126.63.1
+      - string: "168.126.63.1"
         description: kns.kornet.net
diff --git a/nursery/reference-l3-dns-server.yml b/nursery/reference-l3-dns-server.yml
index 369aa63f..96e28bbe 100644
--- a/nursery/reference-l3-dns-server.yml
+++ b/nursery/reference-l3-dns-server.yml
@@ -9,9 +9,9 @@ rule:
     examples:
   features:
     - or:
-      - string: 4.2.2.1
-      - string: 4.2.2.2
-      - string: 4.2.2.3
-      - string: 4.2.2.4
-      - string: 4.2.2.5
-      - string: 4.2.2.6
+      - string: "4.2.2.1"
+      - string: "4.2.2.2"
+      - string: "4.2.2.3"
+      - string: "4.2.2.4"
+      - string: "4.2.2.5"
+      - string: "4.2.2.6"
diff --git a/nursery/reference-opendns-dns-server.yml b/nursery/reference-opendns-dns-server.yml
index ca8bfe60..047bd273 100644
--- a/nursery/reference-opendns-dns-server.yml
+++ b/nursery/reference-opendns-dns-server.yml
@@ -9,5 +9,5 @@ rule:
     examples:
   features:
     - or:
-      - string: 208.67.222.222
-      - string: 208.67.220.220
+      - string: "208.67.222.222"
+      - string: "208.67.220.220"
diff --git a/nursery/reference-quad9-dns-server.yml b/nursery/reference-quad9-dns-server.yml
index 4e13a7af..71a743d5 100644
--- a/nursery/reference-quad9-dns-server.yml
+++ b/nursery/reference-quad9-dns-server.yml
@@ -9,5 +9,5 @@ rule:
     examples:
   features:
     - or:
-      - string: 9.9.9.9
-      - string: 149.112.112.112
+      - string: "9.9.9.9"
+      - string: "149.112.112.112"
diff --git a/nursery/reference-screen-saver-executable.yml b/nursery/reference-screen-saver-executable.yml
index 985d5b25..1c227f46 100644
--- a/nursery/reference-screen-saver-executable.yml
+++ b/nursery/reference-screen-saver-executable.yml
@@ -9,8 +9,8 @@ rule:
       - Persistence::Event Triggered Execution::Screensaver [T1546.002]
   features:
     - and:
-      - string: SCRNSAVE.EXE
+      - string: "SCRNSAVE.EXE"
       - optional:
-        - string: ScreenSaveTimeOut
-        - string: Control Panel\Desktop
+        - string: "ScreenSaveTimeOut"
+        - string: "Control Panel\\Desktop"
         - match: set registry value
diff --git a/nursery/reference-verisign-dns-server.yml b/nursery/reference-verisign-dns-server.yml
index 899b3370..700442c4 100644
--- a/nursery/reference-verisign-dns-server.yml
+++ b/nursery/reference-verisign-dns-server.yml
@@ -9,5 +9,5 @@ rule:
     examples:
   features:
     - or:
-      - string: 64.6.64.6
-      - string: 64.6.65.6
+      - string: "64.6.64.6"
+      - string: "64.6.65.6"
diff --git a/targeting/automated-teller-machine/diebold-nixdorf/load-diebold-nixdorf-atm-library.yml b/targeting/automated-teller-machine/diebold-nixdorf/load-diebold-nixdorf-atm-library.yml
index 1c58ea3b..8c47851c 100644
--- a/targeting/automated-teller-machine/diebold-nixdorf/load-diebold-nixdorf-atm-library.yml
+++ b/targeting/automated-teller-machine/diebold-nixdorf/load-diebold-nixdorf-atm-library.yml
@@ -13,7 +13,7 @@ rule:
   features:
     - or:
       - import: cscwcng.dll
-      - string: CSCWCNG.dll
+      - string: "CSCWCNG.dll"
       - import: cscwcng.CscCngStatusWrite
       - import: cscwcng.CscCngCasRefInit
       - import: cscwcng.CscCngEncryption
@@ -41,30 +41,30 @@ rule:
       - import: cscwcng.CscCngOptimization
       - import: cscwcng.CscCngSelftest
       - import: cscwcng.CscCngEco
-      - string: CscCngStatusWrite
-      - string: CscCngCasRefInit
-      - string: CscCngEncryption
-      - string: CscCngRecovery
-      - string: CscCngService
-      - string: CscCngOpen
-      - string: CscCngReset
-      - string: CscCngClose
-      - string: CscCngDispense
-      - string: CscCngTransport
-      - string: CscCngStatusRead
-      - string: CscCngInit
-      - string: CscCngGetRelease
-      - string: CscCngLock
-      - string: CscCngUnlock
-      - string: CscCngShutter
-      - string: CscCngPowerOff
-      - string: CscCngSelStatus
-      - string: CscCngBim
-      - string: CscCngConfigure
-      - string: CscCngStatistics
-      - string: CscCngControl
-      - string: CscCngPsm
-      - string: CscCngGetTrace
-      - string: CscCngOptimization
-      - string: CscCngSelftest
-      - string: CscCngEco
+      - string: "CscCngStatusWrite"
+      - string: "CscCngCasRefInit"
+      - string: "CscCngEncryption"
+      - string: "CscCngRecovery"
+      - string: "CscCngService"
+      - string: "CscCngOpen"
+      - string: "CscCngReset"
+      - string: "CscCngClose"
+      - string: "CscCngDispense"
+      - string: "CscCngTransport"
+      - string: "CscCngStatusRead"
+      - string: "CscCngInit"
+      - string: "CscCngGetRelease"
+      - string: "CscCngLock"
+      - string: "CscCngUnlock"
+      - string: "CscCngShutter"
+      - string: "CscCngPowerOff"
+      - string: "CscCngSelStatus"
+      - string: "CscCngBim"
+      - string: "CscCngConfigure"
+      - string: "CscCngStatistics"
+      - string: "CscCngControl"
+      - string: "CscCngPsm"
+      - string: "CscCngGetTrace"
+      - string: "CscCngOptimization"
+      - string: "CscCngSelftest"
+      - string: "CscCngEco"
diff --git a/targeting/automated-teller-machine/diebold-nixdorf/reference-diebold-atm-routines.yml b/targeting/automated-teller-machine/diebold-nixdorf/reference-diebold-atm-routines.yml
index 47aa478e..bfc1313c 100644
--- a/targeting/automated-teller-machine/diebold-nixdorf/reference-diebold-atm-routines.yml
+++ b/targeting/automated-teller-machine/diebold-nixdorf/reference-diebold-atm-routines.yml
@@ -10,5 +10,5 @@ rule:
       - b2ad4409323147b63e370745e5209996
   features:
     - or:
-      - string: DBD_AdvFuncDisp  # dispenser
-      - string: DBD_EPP4         # pin pad
+      - string: "DBD_AdvFuncDisp"  # dispenser
+      - string: "DBD_EPP4"         # pin pad
diff --git a/targeting/automated-teller-machine/identify-atm-dispenser-service-provider.yml b/targeting/automated-teller-machine/identify-atm-dispenser-service-provider.yml
index 2742f2aa..f0441c5a 100644
--- a/targeting/automated-teller-machine/identify-atm-dispenser-service-provider.yml
+++ b/targeting/automated-teller-machine/identify-atm-dispenser-service-provider.yml
@@ -11,6 +11,6 @@ rule:
       - 1f094dd65be477d15d871e72f0fdce5e
   features:
     - or:
-      - string: CurrencyDispenser1  # NCR
-      - string: CDM30               # Wincor
-      - string: DBD_AdvFuncDisp     # Diebold
+      - string: "CurrencyDispenser1"  # NCR
+      - string: "CDM30"               # Wincor
+      - string: "DBD_AdvFuncDisp"     # Diebold
diff --git a/targeting/automated-teller-machine/ncr/load-ncr-atm-library.yml b/targeting/automated-teller-machine/ncr/load-ncr-atm-library.yml
index 13344190..3e31f02e 100644
--- a/targeting/automated-teller-machine/ncr/load-ncr-atm-library.yml
+++ b/targeting/automated-teller-machine/ncr/load-ncr-atm-library.yml
@@ -16,5 +16,5 @@ rule:
   features:
     - or:
       - import: msxfs.dll  # Extension for Financial Services (XFS)
-      - string: MSXFS.dll
-      - string: msxfs.dll
+      - string: "MSXFS.dll"
+      - string: "msxfs.dll"
diff --git a/targeting/automated-teller-machine/ncr/reference-ncr-atm-library-routines.yml b/targeting/automated-teller-machine/ncr/reference-ncr-atm-library-routines.yml
index 5123cf64..389664da 100644
--- a/targeting/automated-teller-machine/ncr/reference-ncr-atm-library-routines.yml
+++ b/targeting/automated-teller-machine/ncr/reference-ncr-atm-library-routines.yml
@@ -11,34 +11,34 @@ rule:
       # 971e599e6e707349eccea2fd4c8e5f67  # packed with vmprotect
   features:
     - or:
-      - string: msxfs.dll    # Extension for Financial Services (XFS)
+      - string: "msxfs.dll"    # Extension for Financial Services (XFS)
 
       - api: msxfs.WFSCleanUp
-      - string: WFSCleanUp
+      - string: "WFSCleanUp"
 
       - api: msxfs.WFSClose
-      - string: WFSClose
+      - string: "WFSClose"
 
       - api: msxfs.WFSExecute
-      - string: WFSExecute
+      - string: "WFSExecute"
 
       - api: msxfs.WFSFreeResult
-      - string: WFSFreeResult
+      - string: "WFSFreeResult"
 
       - api: msxfs.WFSGetInfo
-      - string: WFSGetInfo
+      - string: "WFSGetInfo"
 
       - api: msxfs.WFSLock
-      - string: WFSLock
+      - string: "WFSLock"
 
       - api: msxfs.WFSOpen
-      - string: WFSOpen
+      - string: "WFSOpen"
 
       - api: msxfs.WFSRegister
-      - string: WFSRegister
+      - string: "WFSRegister"
 
       - api: msxfs.WFSStartUp
-      - string: WFSStartUp
+      - string: "WFSStartUp"
 
       - api: msxfs.WFSUnlock
-      - string: WFSUnlock
+      - string: "WFSUnlock"