refactor(yara): Use the new registry data parameter name

Author: rabbitstack

pkg/yara/scanner.go

@@ -334,7 +334,7 @@ func (s scanner) Scan(e *event.Event) (bool, error) {
 		if typ := e.Params.TryGetUint32(params.RegValueType); typ != registry.BINARY {
 			return false, nil
 		}
-		v, err := e.Params.Get(params.RegValue)
+		v, err := e.Params.Get(params.RegData)
 		if err != nil {
 			// value not attached to the event
 			return false, nil

pkg/yara/scanner_test.go

@@ -933,7 +933,7 @@ func TestScan(t *testing.T) {
 					PID:      565,
 					Params: event.Params{
 						params.RegValueType: {Name: params.RegValueType, Type: params.Uint32, Value: uint32(registry.BINARY)},
-						params.RegValue:     {Name: params.RegValue, Type: params.Binary, Value: data},
+						params.RegData:      {Name: params.RegValue, Type: params.Binary, Value: data},
 						params.RegPath:      {Name: params.RegPath, Type: params.UnicodeString, Value: `HKEY_LOCAL_MACHINE\CurrentControlSet\Control\DeviceGuard\Mal`},
 					},
 					Metadata: make(map[event.MetadataKey]any),