diff --git a/docs/reference/eql/detect-threats-with-eql.asciidoc b/docs/reference/eql/detect-threats-with-eql.asciidoc
index 86d6877432100..ffbbc75fe3fcb 100644
--- a/docs/reference/eql/detect-threats-with-eql.asciidoc
+++ b/docs/reference/eql/detect-threats-with-eql.asciidoc
@@ -299,8 +299,8 @@ GET /my-index-000001/_eql/search
 {
   "query": """
     sequence by process.pid
-      [process where process.name == 'regsvr32.exe']
-      [library where dll.name == 'scrobj.dll']
+      [process where process.name == "regsvr32.exe"]
+      [library where dll.name == "scrobj.dll"]
       [network where true]
   """
 }