Hunting with Elastic Security: Detecting covert data exfiltration