fixing last issues

Author: rayne-wiselman

articles/defender-for-cloud/alerts-reference.md

@@ -153,7 +153,7 @@ Microsoft Defender for Servers Plan 2 provides unique detections and alerts, in
 |**Antimalware unusual file exclusion in your virtual machine**<br>(VM_UnusualAmFileExclusion)                                                                    | Unusual file exclusion from antimalware extension was detected in your virtual machine by analyzing the Azure Resource Manager operations in your subscription.<br>Attackers might exclude files from the antimalware scan on your virtual machine to prevent detection while running arbitrary code or infecting the machine with malware.                                                                                              | Defense Evasion                       | Medium   |
 |**Behavior similar to ransomware detected [seen multiple times]**|Analysis of host data on %{Compromised Host} detected the execution of files that have resemblance of known ransomware that can prevent users from accessing their system or personal files, and demands ransom payment in order to regain access. This behavior was seen [x] times today on the following machines: [Machine names]|-|High|
 |**Communication with suspicious domain identified by threat intelligence**<br>(AzureDNS_ThreatIntelSuspectDomain) | Communication with suspicious domain was detected by analyzing DNS transactions from your resource and comparing against known malicious domains identified by threat intelligence feeds. Communication to malicious domains is frequently performed by attackers and could imply that your resource is compromised.                                                                            | Initial Access, Persistence, Execution, Command And Control, Exploitation             | Medium   |
-|**Container with a miner image detected**<br>(VM_MinerInContainerImage)           | Machine logs indicate execution of a Docker container that run an image associated with a digital currency mining.                                                                                                                                                                                        | Execution                                    | High     |
+|**Container with a miner image detected**<br>(VM_MinerInContainerImage)           | Machine logs indicate execution of a Docker container that runs an image associated with a digital currency mining.                                                                                                                                                                                        | Execution                                    | High     |
 |**Custom script extension with suspicious command in your virtual machine**<br>(VM_CustomScriptExtensionSuspiciousCmd)                                           | Custom script extension with suspicious command was detected in your virtual machine by analyzing the Azure Resource Manager operations in your subscription.<br>Attackers may use custom script extension to execute a malicious code on your virtual machine via the Azure Resource Manager.                                                                                                                                           | Execution                             | Medium   |
 |**Custom script extension with suspicious entry-point in your virtual machine**<br>(VM_CustomScriptExtensionSuspiciousEntryPoint)                                | Custom script extension with a suspicious entry-point was detected in your virtual machine by analyzing the Azure Resource Manager operations in your subscription. The entry-point refers to a suspicious GitHub repository.<br>Attackers may use custom script extensions to execute malicious code on your virtual machines via the Azure Resource Manager.                                                                           | Execution                             | Medium   |
 |**Custom script extension with suspicious payload in your virtual machine**<br>(VM_CustomScriptExtensionSuspiciousPayload)                                       | Custom script extension with a payload from a suspicious GitHub repository was detected in your virtual machine by analyzing the Azure Resource Manager operations in your subscription.<br>Attackers may use custom script extensions to execute malicious code on your virtual machines via the Azure Resource Manager.                                                                                                                | Execution                             | Medium   |