Learn Editor: Update validate-antimalware.md

Author: joshgingras

defender-endpoint/validate-antimalware.md

@@ -59,31 +59,29 @@ Run an AV detection test to verify that the device is properly onboarded and rep
 
 ### Linux/macOS
 
-1. Ensure that real-time protection is enabled (denoted by a result of 1 from running the following command):
+1. Ensure that real-time protection is enabled (denoted by a result of "true" from running the following command):
 
-```bash
-mdatp health --field real_time_protection_enabled
-```
+    ```bash
+    mdatp health --field real_time_protection_enabled
+    ```
 
-1. Open a Terminal window. Copy and execute the following command:
+2. Open a Terminal window. Copy and execute the following command:
 
-  
-Linux
 
+Linux
 
 ```bash
-curl -o ~/tmp/eicar.com.txt https://secure.eicar.org/eicar.com.txt
+```bash
+curl -o eicar.com.txt https://secure.eicar.org/eicar.com.txt
 ```
+```macOS
 
-macOS
-
-
+```
 ```bash
 curl -o ~/Downloads/eicar.com.txt https://secure.eicar.org/eicar.com.txt
 ```
+```3. Execute the following command and verify the file has been quarantined by Defender for Endpoint. The command will list all detected threats:
 
-3. The file has been quarantined by Defender for Endpoint on Mac. Use the following command to list all the detected threats:
-
-```bash
-mdatp threat list
-```
+    ```bash
+    mdatp threat list
+    ```