Update alerts-reference.md

-------
cc: @memildin

Author: dotanpatrich

articles/defender-for-cloud/alerts-reference.md

@@ -362,6 +362,10 @@ Microsoft Defender for Containers provides security alerts on the cluster level
 | **Suspicious file timestamp modification (Preview)**<br>(K8S.NODE_TimestampTampering)                              | Analysis of host/device data detected a suspicious timestamp modification. Attackers will often copy timestamps from existing legitimate files to new tools to avoid detection of these newly dropped files.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | Persistence, DefenseEvasion                                                                                                                                                     | Low           |
 | **Suspicious request to Kubernetes API (Preview)**<br>(K8S.NODE_KubernetesAPI)                                     | Analysis of processes running within a container indicates that a suspicious request was made to the Kubernetes API. The request was sent from a container in the cluster. Although this behavior can be intentional, it might indicate that a compromised container is running in the cluster.                                                                                                                                                                                                                                                                                                                                                                                                                            | Execution                                                                                                                                                                       | Medium        |
 | **Suspicious request to the Kubernetes Dashboard (Preview)**<br>(K8S.NODE_KubernetesDashboard)                     | Analysis of processes running within a container indicates that a suspicious request was made to the Kubernetes Dashboard. The request was sent from a container in the cluster. Although this behavior can be intentional, it might indicate that a compromised container is running in the cluster.                                                                                                                                                                                                                                                                                                                                                                                                                      | Execution                                                                                                                                                                       | Medium        |
+| **Potential crypto coin miner started (Preview)**<br>(K8S.NODE_CryptoCoinMinerExecution)                     | Analysis of processes running within a container detected a process being started in a way normally associated with digital currency mining.                                                                                                                                                                                                                                                                                                                                                                                                                      | Execution                                                                                                                                                                       | Medium        |
+| **Suspicious password access (Preview)**<br>(K8S.NODE_SuspectPasswordFileAccess)                     | Analysis of processes running within a container detected suspicious access to encrypted user passwords.                                                                                                                                                                                                                                                                                                                                                                                                                      | Persistence                                                                                                                                                                       | Informational        |
+| **Suspicious use of DNS over HTTPS (Preview)**<br>(K8S.NODE_SuspiciousDNSOverHttps)                     | Analysis of processes running within a container indicates the use of a DNS call over HTTPS in an uncommon fashion. This technique is used by attackers to hide calls out to suspect or malicious sites.                                                                                                                                                                                                                                                                                                                                                                                                                      | DefenseEvasion, Exfiltration                                                                                                                                                                       | Medium        |
+| **A possible connection to malicious location has been detected. (Preview)**<br>(K8S.NODE_ThreatIntelCommandLineSuspectDomain)                     | Analysis of processes running within a container detected a connection to a location that has been reported to be malicious or unusual. This is an indicator that a compromise may have occured.                                                                                                                                                                                                                                                                                                                                                                                                                      | InitialAccess                                                                                                                                                                       | Medium        |
 |                                                                                                                    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                                                                                                                                                                                 |               |