Building Your Own Falcon MCP: ThreatFox + Cross-Reference Against 6 Million Hosts
I saw a post describing how Falcon MCP is used to track APT C2 infrastructure. Tonight I replicated it with free sources — and found an active Cobalt Strike C2 in my database.