A recently published attack technique, known as APC Tandem, is a useful reminder of an uncomfortable truth: your endpoint detection and response (EDR) platform does not see everything. This isn’t an attacker’s how-to — it’s a defender’s wake-up call. Here’s what this class of technique tells us about the limits of EDR, and what to do about it.
A quick refresher: process injection
Attackers like to run their code inside a legitimate, trusted process rather than as an obvious standalone program. That’s process injection — and it’s a favourite because it helps malicious activity blend into normal system behaviour. For years, EDR products have detected this by watching for the well-known Windows API calls typically involved in classic injection (such as VirtualAllocEx, WriteProcessMemory and CreateRemoteThread).
Why APC Tandem matters
The significance of APC Tandem isn’t the specific trick — it’s the pattern. Instead of using the API calls EDR is watching, the technique reaches the same outcome through a chain of primitives that are each, individually, completely legitimate. The result is functionally identical to classic injection, but assembled from steps that don’t light up traditional detection.
In public testing, only 1 of 36 security engines flagged it — and even that was a generic heuristic, not a rule built for the technique. That single statistic is the whole lesson: detection built on known patterns will always lose ground to an attacker willing to find the next unmonitored path.
What this means for defenders
1. API-pattern monitoring has structural limits. Signature- and pattern-based detection is necessary but not sufficient. Every newly published evasion simply pushes the attacker to the next primitive your tools aren’t watching yet.
2. Look beyond the endpoint. Behavioural analysis at the process level — anomalous thread activity, unusual cross-process behaviour, suspicious sequences of otherwise-legitimate actions — is where techniques like this become visible. Pair endpoint telemetry with network and identity signals.
3. Test what you actually detect. The only way to know what your environment catches is to exercise it with the techniques real attackers use. Lab assumptions and vendor datasheets are not the same as a validated detection. This is exactly what red team operations are for.
4. EDR alone is never enough. Layered defence wins: strong identity and access controls, credential hygiene, network monitoring and managed detection close the gaps a single endpoint tool will always leave. A managed approach such as Managed XDR correlates signals across endpoints, network and users instead of relying on one vantage point.
5. Prevention beats detection. The most valuable insight from the research isn’t technical at all: the most dangerous blind spot isn’t the technique your EDR misses — it’s the access you never should have granted. Least-privilege, segmentation and tight access control shrink what any injection technique can reach in the first place.
The takeaway
APC Tandem will be superseded by the next technique, and the one after that. Chasing individual tricks is a losing game. What endures is a layered, continuously-tested defence — and the discipline of granting as little access as possible. For organisations across the UAE and the GCC, where attackers are well-resourced and persistent, that mindset is the real protection.
Want to know what your EDR actually detects — and what it doesn’t? A Rootsec red team operation validates your defences against real-world techniques. Book a free consultation.
