Hunting with Elastic Security: Detecting credential dumping with ES|QL