Elastic Cloud SIEM Abused for Data Exfiltration: Detection and Hunting Guide

---
title: Potential Data Exfiltration to Elastic Cloud Infrastructure
id: 8a5b2c11-4d3e-4f8a-9c12-3d4a5e6f7g8h
status: experimental
description: Detects processes attempting to connect to known Elastic Cloud infrastructure, which may indicate abuse of Elastic services for data exfiltration or C2.
references:
 - https://www.infosecurity-magazine.com/news/elastic-cloud-siem-manage-stolen/
author: Security Arsenal
date: 2025/03/25
tags:
 - attack.exfiltration
 - attack.t1567.001
logsource:
 category: network_connection
 product: windows
detection:
 selection:
   DestinationHostname|contains:
     - '.elastic.co'
     - '.es.elastic-cloud.com'
 filter_main_legit_apps:
   Image|contains:
     - '\Program Files\Elastic\'
     - '\Program Files (x86)\Elastic\'
 filter_main_admin:
   User|contains:
     - 'ADMIN'
     - 'SYSTEM'
 condition: selection and not 1 of filter_main*
falsepositives:
  - Legitimate use of Elastic Cloud by administrators (rare on endpoints)
level: high
---
title: Suspicious CLI Upload to Elastic Cloud
description: Detects command-line tools like curl or PowerShell making web requests to Elastic Cloud endpoints, indicative of manual exfiltration scripts.
id: 9b6c3d22-5e4f-0g9h-1d2e-3f4a5b6c7d8e
status: experimental
author: Security Arsenal
date: 2025/03/25
references:
 - https://www.infosecurity-magazine.com/news/elastic-cloud-siem-manage-stolen/
tags:
 - attack.execution
 - attack.t1059.001
logsource:
 category: process_creation
 product: windows
detection:
 selection_tools:
   Image|endswith:
     - '\curl.exe'
     - '\powershell.exe'
     - '\python.exe'
 selection_cli:
   CommandLine|contains:
     - '.elastic.co'
     - '.es.elastic-cloud.com'
 condition: all of selection_*
falsepositives:
  - Administrator troubleshooting or legitimate DevOps scripts
level: medium


**KQL (Microsoft Sentinel / Defender)**

// Hunt for outbound network connections to Elastic Cloud endpoints
// Excludes internal IPs and focuses on public egress
DeviceNetworkEvents
| where RemoteUrl has "elastic.co" or RemoteUrl has "es.elastic-cloud.com"
| where InitiatingProcessFileName !in ("elastic_agent.exe", "metricbeat.exe", "filebeat.exe", "logstash.exe")
| extend Timestamp = TimeGenerated, DeviceName = DeviceName, InitiatingUser = InitiatingProcessAccountName, RemoteIP = RemoteIP, RemoteURL = RemoteUrl
| project Timestamp, DeviceName, InitiatingUser, InitiatingProcessFileName, RemoteIP, RemoteURL, BytesSent, BytesReceived
| order by Timestamp desc


**Velociraptor VQL**

-- Hunt for processes connecting to Elastic Cloud domains
SELECT chain.pid, chain.name, process.cmdline, process.username, chain.remote_address
FROM chain(pid=pid)
WHERE foreach(split(string=chain.remote_address, sep=":"), {
    // Check if remote address resolves to or contains Elastic domains
    // Note: This query assumes netstat data availability via chain()
    _val =~ "\.elastic\.co"
}) OR process.cmdline =~ "\.elastic\.co"


**Remediation Script (PowerShell)**

<#
.SYNOPSIS
    Identify and block unauthorized Elastic Cloud endpoints via Windows Firewall.
.DESCRIPTION
    This script checks for active connections to Elastic Cloud and creates a firewall rule to block them if they do not originate from approved administrative sources.
#>

$ElasticDomains = @("*.elastic.co", "*.es.elastic-cloud.com")
$LogPath = "$env:TEMP\ElasticCloudAudit.log"

# Get active TCP connections to Elastic domains
Write-Host "[+] Auditing active connections to Elastic Cloud infrastructure..."
$ActiveConnections = Get-NetTCPConnection | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess

$SuspiciousConnections = @()

foreach ($Conn in $ActiveConnections) {
    $Process = Get-Process -Id $Conn.OwningProcess -ErrorAction SilentlyContinue
    if ($Process) {
        # Basic heuristic: Check if process path is NOT the official Elastic Agent directory
        # Adjust path as per your install location
        $LegitPath = "C:\Program Files\Elastic\"
        if ($Process.Path -notlike "$LegitPath*") {
             # Further check would require DNS resolution, here we flag non-standard processes
             if ($Conn.RemoteAddress -notlike "127.*" -and $Conn.RemoteAddress -notlike "10.*" -and $Conn.RemoteAddress -notlike "192.168.*") {
                $Details = [PSCustomObject]@{
                    ProcessName = $Process.ProcessName
                    PID = $Process.Id
                    Path = $Process.Path
                    RemoteIP = $Conn.RemoteAddress
                    RemotePort = $Conn.RemotePort
                    Timestamp = Get-Date
                }
                $SuspiciousConnections += $Details
             }
        }
    }
}

if ($SuspiciousConnections.Count -gt 0) {
    Write-Host "[!] Potential unauthorized Elastic Cloud connections found." -ForegroundColor Red
    $SuspiciousConnections | Format-Table -AutoSize
    $SuspiciousConnections | Out-File -FilePath $LogPath -Append
    Write-Host "[+] Log saved to $LogPath"

    # Warning: Implementing a block rule strictly requires thorough testing to avoid breaking legitimate apps.
    Write-Host "[!] Action Required: Review the log above. If traffic is confirmed malicious, block the specific RemoteIPs using firewall rules."
} else {
    Write-Host "[+] No obvious non-Elastic-agent connections found." -ForegroundColor Green
}