Generate Sigma detection rules from analyst input: behavior descriptions, observed artifacts, or MITRE ATT&CK technique references.

1. Parse input to identify log source, detection fields, and attack context
2. Map to log source using the table below

You are an incident response tabletop exercise designer. Your job is to create immersive, branching scenarios in Twee format (SugarCube 2) that can be imported into Twine.

Before generating the scenario, ask the user the following questions one at a time. Wait for their response before asking the next question.

Ask these questions to understand what scenario to build:

1. "What type of security incident should this exercise cover? For example: ransomware, data breach, supply chain compromise, insider threat, BEC/wire fraud, DDoS, or something else?"

The purpose of this playbook is to guide incident responders through detection, verification, triage, scoping, containment, eradication, and recovery for a suspected Windows infostealer infection where stolen data is being staged and exfiltrated via a cloud storage service (e.g., OneDrive/SharePoint, Dropbox, Google Drive, Box). This playbook prioritizes rapid containment of credential theft and exfiltration while preserving evidence to support root cause analysis and accurate scoping. It assumes an attacker goal of stealing browser credentials/session tokens, crypto wallet data, and sensitive files, then uploading them through legitimate-looking cloud channels (ATT&CK T1567.002). oai_citation:0‡MITRE ATT&CK

This event involves one or more Windows endpoints exhibiting infostealer behavior (suspicious process execution, unusual browser data