diff --git a/doc/3-monitoring-basics.md b/doc/3-monitoring-basics.md
index 084ace3ce..4c3c1e6ae 100644
--- a/doc/3-monitoring-basics.md
+++ b/doc/3-monitoring-basics.md
@@ -669,7 +669,7 @@ can also be inherited from a parent template using additive inheritance (`+=`).
     object CheckCommand "my-disk" {
       import "plugin-check-command"
 
-      command = PluginDir + "/check_disk"
+      command = [ PluginDir + "/check_disk" ]
 
       arguments = {
         "-w" = "$disk_wfree$%"
@@ -713,7 +713,7 @@ macro value can be resolved by Icinga 2.
     object CheckCommand "check_http" {
       import "plugin-check-command"
 
-      command = PluginDir + "/check_http"
+      command = [ PluginDir + "/check_http" ]
 
       arguments = {
         "-H" = "$http_vhost$"
@@ -790,7 +790,7 @@ the service is applied to. If not set, the check command `my-ssh` will omit the
     object CheckCommand "my-ssh" {
       import "plugin-check-command"
 
-      command = PluginDir + "/check_ssh"
+      command = [ PluginDir + "/check_ssh" ]
 
       arguments = {
         "-p" = "$ssh_port$"
diff --git a/doc/6-configuring-icinga-2.md b/doc/6-configuring-icinga-2.md
index 5e7e77744..1440e1b28 100644
--- a/doc/6-configuring-icinga-2.md
+++ b/doc/6-configuring-icinga-2.md
@@ -785,7 +785,7 @@ Example:
     object CheckCommand "check_http" {
       import "plugin-check-command"
 
-      command = PluginDir + "/check_http"
+      command = [ PluginDir + "/check_http" ]
 
       arguments = {
         "-H" = "$http_vhost$"
@@ -822,7 +822,7 @@ Attributes:
   Name            |Description
   ----------------|----------------
   methods         |**Required.** The "execute" script method takes care of executing the check. In virtually all cases you should import the "plugin-check-command" template to take care of this setting.
-  command         |**Required.** The command. This can either be an array of individual command arguments. Alternatively a string can be specified in which case the shell interpreter (usually /bin/sh) takes care of parsing the command.
+  command         |**Required.** The command. This can either be an array of individual command arguments. Alternatively a string can be specified in which case the shell interpreter (usually /bin/sh) takes care of parsing the command. When using the "arguments" attribute this must be an array.
   env             |**Optional.** A dictionary of macros which should be exported as environment variables prior to executing the command.
   vars            |**Optional.** A dictionary containing custom attributes that are specific to this command.
   timeout         |**Optional.** The command timeout in seconds. Defaults to 5 minutes.
diff --git a/itl/command-plugins.conf b/itl/command-plugins.conf
index 1261a7d3e..da86b48a2 100644
--- a/itl/command-plugins.conf
+++ b/itl/command-plugins.conf
@@ -20,9 +20,7 @@
 template CheckCommand "ping-common" {
 	import "plugin-check-command"
 
-	command = [
-		PluginDir + "/check_ping"
-	]
+	command = [ PluginDir + "/check_ping" ]
 
 	arguments = {
 		"-H" = "$ping_address$"
@@ -145,7 +143,7 @@ object CheckCommand "tcp" {
 object CheckCommand "ssl" {
 	import "plugin-check-command"
 
-	command = PluginDir + "/check_tcp"
+	command = [ PluginDir + "/check_tcp" ]
 
 	arguments = {
 		"-H" = "$ssl_address$"
@@ -176,7 +174,7 @@ object CheckCommand "udp" {
 object CheckCommand "http" {
 	import "plugin-check-command"
 
-	command = PluginDir + "/check_http"
+	command = [ PluginDir + "/check_http" ]
 
 	arguments = {
 		"-H" = "$http_vhost$"
@@ -210,7 +208,7 @@ object CheckCommand "http" {
 object CheckCommand "ftp" {
 	import "plugin-check-command"
 
-	command = PluginDir + "/check_ftp"
+	command = [ PluginDir + "/check_ftp" ]
 
 	arguments = {
 		"-H" = "$ftp_address$"
@@ -222,7 +220,7 @@ object CheckCommand "ftp" {
 object CheckCommand "smtp" {
 	import "plugin-check-command"
 
-	command = PluginDir + "/check_smtp"
+	command = [ PluginDir + "/check_smtp" ]
 
 	arguments = {
 		"-H" = "$smtp_address$"
@@ -236,8 +234,7 @@ object CheckCommand "smtp" {
 object CheckCommand "ssmtp" {
 	import "plugin-check-command"
 
-	command = PluginDir + "/check_ssmtp"
-
+	command = [ PluginDir + "/check_ssmtp" ]
 	arguments = {
 		"-H" = "$ssmtp_address$"
 		"-p" = "$ssmtp_port$"
@@ -250,7 +247,7 @@ object CheckCommand "ssmtp" {
 object CheckCommand "imap" {
   	import "plugin-check-command"
 
-  	command = PluginDir + "/check_imap"
+  	command = [ PluginDir + "/check_imap" ]
 
 	arguments = {
 		"-H" = "$imap_address$"
@@ -263,7 +260,7 @@ object CheckCommand "imap" {
 object CheckCommand "simap" {
   	import "plugin-check-command"
 
-	  command = PluginDir + "/check_simap"
+	  command = [ PluginDir + "/check_simap" ]
 
 	arguments = {
 		"-H" = "$simap_address$"
@@ -276,7 +273,7 @@ object CheckCommand "simap" {
 object CheckCommand "pop" {
 	import "plugin-check-command"
 
-  	command = PluginDir + "/check_pop"
+  	command = [ PluginDir + "/check_pop" ]
 
 	arguments = {
 		"-H" = "$pop_address$"
@@ -289,7 +286,7 @@ object CheckCommand "pop" {
 object CheckCommand "spop" {
   	import "plugin-check-command"
 
-	command = PluginDir + "/check_spop"
+	command = [ PluginDir + "/check_spop" ]
 
 	arguments = {
 		"-H" = "$spop_address$"
@@ -302,7 +299,7 @@ object CheckCommand "spop" {
 object CheckCommand "ntp_time" {
 	import "plugin-check-command"
 
-	command = PluginDir + "/check_ntp_time"
+	command = [ PluginDir + "/check_ntp_time" ]
 
 	arguments = {
 		"-H" = "$ntp_address$"
@@ -314,7 +311,7 @@ object CheckCommand "ntp_time" {
 object CheckCommand "ssh" {
 	import "plugin-check-command"
 
-	command = PluginDir + "/check_ssh"
+	command = [ PluginDir + "/check_ssh" ]
 
 	arguments = {
 		"-p" = "$ssh_port$"
@@ -331,7 +328,7 @@ object CheckCommand "ssh" {
 object CheckCommand "disk" {
 	import "plugin-check-command"
 
-	command = PluginDir + "/check_disk"
+	command = [ PluginDir + "/check_disk" ]
 
 	arguments = {
 		"-w" = "$disk_wfree$%"
@@ -345,7 +342,7 @@ object CheckCommand "disk" {
 object CheckCommand "users" {
 	import "plugin-check-command"
 
-	command = PluginDir + "/check_users"
+	command = [ PluginDir + "/check_users" ]
 
 	arguments = {
 		"-w" = "$users_wgreater$"
@@ -359,7 +356,7 @@ object CheckCommand "users" {
 object CheckCommand "procs" {
 	import "plugin-check-command"
 
-	command = PluginDir + "/check_procs"
+	command = [ PluginDir + "/check_procs" ]
 
 	arguments = {
 		"-w" = "$procs_wgreater$"
@@ -373,7 +370,7 @@ object CheckCommand "procs" {
 object CheckCommand "swap" {
 	import "plugin-check-command"
 
-	command = PluginDir + "/check_swap"
+	command = [ PluginDir + "/check_swap" ]
 
 	arguments = {
 		"-w" = "$swap_wfree$%"
@@ -387,7 +384,7 @@ object CheckCommand "swap" {
 object CheckCommand "load" {
 	import "plugin-check-command"
 
-	command = PluginDir + "/check_load"
+	command = [ PluginDir + "/check_load" ]
 
 	arguments = {
 		"-w" = "$load_wload1$,$load_wload5$,$load_wload15$"
@@ -406,7 +403,7 @@ object CheckCommand "load" {
 object CheckCommand "snmp" {
 	import "plugin-check-command"
 
-	command = PluginDir + "/check_snmp"
+	command = [ PluginDir + "/check_snmp" ]
 
 	arguments = {
 		"-H" = "$snmp_address$"
@@ -433,7 +430,7 @@ object CheckCommand "snmp" {
 object CheckCommand "snmpv3" {
 	import "plugin-check-command"
 
-	command = PluginDir + "/check_snmp"
+	command = [ PluginDir + "/check_snmp" ]
 
 	arguments = {
 		"-H" = "$snmpv3_address$"
@@ -463,15 +460,13 @@ object CheckCommand "snmp-uptime" {
 object CheckCommand "apt" {
 	import "plugin-check-command"
 
-	command = [
-		PluginDir + "/check_apt"
-	]
+	command = [ PluginDir + "/check_apt" ]
 }
 
 object CheckCommand "dhcp" {
 	import "plugin-check-command"
 
-	command = PluginDir + "/check_dhcp"
+	command = [ PluginDir + "/check_dhcp" ]
 
 	arguments = {
 		"-s" = "$dhcp_serverip$"
@@ -490,7 +485,7 @@ object CheckCommand "dhcp" {
 object CheckCommand "dns" {
 	import "plugin-check-command"
 
-	command = PluginDir + "/check_dns"
+	command = [ PluginDir + "/check_dns" ]
 
 	arguments = {
 		"-H" = "$dns_lookup$"
@@ -508,7 +503,7 @@ object CheckCommand "dns" {
 object CheckCommand "dig" {
 	import "plugin-check-command"
 
-	command = PluginDir + "/check_dig"
+	command = [ PluginDir + "/check_dig" ]
 
 	arguments = {
 		"-H" = "$dig_server$"
@@ -521,7 +516,7 @@ object CheckCommand "dig" {
 object CheckCommand "nscp" {
 	import "plugin-check-command"
 
-	command = PluginDir + "/check_nt"
+	command = [ PluginDir + "/check_nt" ]
 
 	arguments = {
 		"-H" = "$nscp_address$"
@@ -544,7 +539,7 @@ object CheckCommand "nscp" {
 object CheckCommand "by_ssh" {
 	import "plugin-check-command"
 
-	command = PluginDir + "/check_by_ssh"
+	command = [ PluginDir + "/check_by_ssh" ]
 
 	arguments = {
 		"-H" = "$by_ssh_address$"
@@ -567,7 +562,7 @@ object CheckCommand "by_ssh" {
 object CheckCommand "ups" {
 	import "plugin-check-command"
 
-	command = PluginDir + "/check_ups"
+	command = [ PluginDir + "/check_ups" ]
 
 	arguments = {
 		"-H" = "$ups_address$"
@@ -581,7 +576,7 @@ object CheckCommand "ups" {
 object CheckCommand "nrpe" {
 	import "plugin-check-command"
 
-	command = PluginDir + "/check_nrpe"
+	command = [ PluginDir + "/check_nrpe" ]
 
  	arguments = {
 		"-H" = "$nrpe_address$"
@@ -606,6 +601,7 @@ object CheckCommand "nrpe" {
 /* Contrib plugins */
 object CheckCommand "running_kernel" {
 	import "plugin-check-command"
+
 	command = [ "sudo", PluginDir + "/check_running_kernel" ]
 }
 
diff --git a/lib/icinga/command.cpp b/lib/icinga/command.cpp
index 51d24ddc8..50930666a 100644
--- a/lib/icinga/command.cpp
+++ b/lib/icinga/command.cpp
@@ -18,10 +18,13 @@
  ******************************************************************************/
 
 #include "icinga/command.hpp"
+#include "base/scriptfunction.hpp"
+#include "config/configcompilercontext.hpp"
 
 using namespace icinga;
 
 REGISTER_TYPE(Command);
+REGISTER_SCRIPTFUNCTION(ValidateCommandAttributes, &Command::ValidateAttributes);
 
 int Command::GetModifiedAttributes(void) const
 {
@@ -40,3 +43,12 @@ void Command::SetModifiedAttributes(int flags, const MessageOrigin& origin)
 		OnVarsChanged(GetSelf(), origin);
 	}
 }
+
+void Command::ValidateAttributes(const String& location, const Dictionary::Ptr& attrs)
+{
+	if (attrs->Contains("arguments") && !attrs->Get("command").IsObjectType<Array>()) {
+		ConfigCompilerContext::GetInstance()->AddMessage(true, "Validation failed for " +
+		    location + ": Attribute 'command' must be an array if the 'arguments' attribute is set.");
+	}
+}
+
diff --git a/lib/icinga/command.hpp b/lib/icinga/command.hpp
index 83ad778c5..b1f05c68e 100644
--- a/lib/icinga/command.hpp
+++ b/lib/icinga/command.hpp
@@ -39,6 +39,8 @@ public:
 
 	//virtual Dictionary::Ptr Execute(const Object::Ptr& context) = 0;
 
+	static void ValidateAttributes(const String& location, const Dictionary::Ptr& attrs);
+
 	int GetModifiedAttributes(void) const;
 	void SetModifiedAttributes(int flags, const MessageOrigin& origin = MessageOrigin());
 };
diff --git a/lib/icinga/icinga-type.conf b/lib/icinga/icinga-type.conf
index 0b9298a19..7f98f5deb 100644
--- a/lib/icinga/icinga-type.conf
+++ b/lib/icinga/icinga-type.conf
@@ -182,11 +182,12 @@
 }
 
 %type Command {
-    %require "methods",
-    %attribute %dictionary "methods" {
-	%require "execute",
-	%attribute %string "execute"
-    },
+	%validator "ValidateCommandAttributes",
+	%require "methods",
+	%attribute %dictionary "methods" {
+		%require "execute",
+		%attribute %string "execute"
+	},
 
 /*  %if (methods.execute == "PluginNotification" || methods.execute == "PluginCheck" || methods.execute == "PluginEvent") { */
 //	%require "command",