Update NickelRegIOCPatterns.yaml

Adding in extra backslash for string match, change from ObjectValue to ObjectValueName for match, removing extra paren at the end.

Hunting Queries/MultipleDataSources/NickelRegIOCPatterns.yaml

@@ -23,17 +23,17 @@ tags:
   - Solorigate
   - NOBELIUM
 query: |
-  let reg_paths = dynamic(["HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main", 
-                          "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery", 
-                          "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy", 
-                          "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap"
+  let reg_paths = dynamic(["HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main", 
+                          "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Recovery", 
+                          "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Privacy", 
+                          "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap"
                           ]);
   let reg_keys = dynamic(["Start Page", "DisableFirstRunCustomize", "RunOnceComplete", "RunOnceHasShown", "Check_Associations", "AutoRecover", "ClearBrowsingHistoryOnExit", "Completed", "IEHarden"]);
   (union isfuzzy=true
   (
   SecurityEvent
   | where EventID == 4657
-  | where ObjectName has_any (reg_paths) and ObjectValue has_any (reg_keys)
+  | where ObjectName has_any (reg_paths) and ObjectValueName has_any (reg_keys)
   | summarize Count=count() by Computer, Account, ObjectName
   | extend AccountCustomEntity = Account, HostCustomEntity = Computer
   ),
@@ -57,7 +57,6 @@ query: |
   | extend AccountCustomEntity = Username, HostCustomEntity = Dvc
   )
   )
-  )
 entityMappings:
   - entityType: Account
     fieldMappings:
@@ -66,4 +65,4 @@ entityMappings:
   - entityType: Host
     fieldMappings:
       - identifier: FullName
-        columnName: HostCustomEntity
+        columnName: HostCustomEntity