APC Tandem: A Primitive-Chaining Process Injection That Slips Past Common EDR Triggers

Original source: Primitive Process Injection: APC Tandem by S12 — 0x12Dark Development, published on Medium in May 2026.

This article is an original English rewrite of the technique walkthrough. Code blocks, the PoC screenshot, the Kleenscan scan output and the YARA rule are reproduced verbatim from the source with attribution. Full credit for the technique,…

https://core-jmp.org/2026/05/apc-tandem-primitive-process-injection/