ION28/BLUESPAWN

Health v2 · maintenance only

Adoption not part of the score

1334 stars · 177 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

BLUESPAWN is an open-source active defense and endpoint detection and response (EDR) tool for Windows. It helps blue teams detect, identify, and eliminate malicious activity and malware in real time, with detections mapped to MITRE ATT&CK.

Use cases

• detect malware on windows endpoints
• threat hunting on windows systems
• monitor systems for active attacker behavior
• map endpoint detections to mitre att&ck
• open-source alternative to commercial EDR
• hunt persistence mechanisms on compromised hosts

When to choose

• you are a blue team defending Windows endpoints
• you want transparent, open-source detection logic mapped to MITRE ATT&CK
• you need a lightweight tool to hunt and remove malware during incident response

When to avoid

• you need cross-platform (Linux/macOS) endpoint protection
• you require enterprise-grade EDR with managed response and support
• you need protection for non-Windows servers or cloud workloads

Facets

application · maturity active

security monitoring alerting vulnerability-scanning security windows developer-tools windows cpp edr blue-team mitre-attack threat-hunting active-defense endpoint-security malware-detection

Member repositories

For agents

markdown · JSON · MCP: product_card(name="ION28/BLUESPAWN")