Threat Actor: OilRig(APT34)
Target Sector: Government & Critical Infrastructure (Middle East)

Summary

Help AG’s CTI and DFIR teams recently observed Iranian-linked threat actor OilRig employing a lesser-known but effective method to maintain persistence and bypass application whitelisting controls in enterprise environments. The technique revolves around abusing Windows RemoteApp configuration via the Registry.

Using PowerShell, the actor executed:

Set-ItemProperty “HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\TSAppAllowList” -Name fDisabledAllowList -Value 1

This command disables RemoteApp’s application allow list, effectively allowing any application to run as a RemoteApp—turning a legitimate remote access tool into a stealthy backdoor.

How It Works

RemoteApp is part of Microsoft’s Remote Desktop Services (RDS), used to publish and restrict access to specific applications for remote users. By default, only explicitly allowed applications can be launched.

But with fDisabledAllowList = 1, attackers remove that restriction. This opens the door to arbitrary executable launches under the guise of sanctioned remote activity—evading both host-based defenses and user behavior analytics.

By creating .rdp session and editing it, Windows allows to specify “remoteapplicationprogram:” and then add the path of application to run remotely.

Why RemoteApp?

• Covert Execution: Applications launched via RemoteApp blend into RDS traffic—no unusual parent-child relationships or visible pop-ups.
• Bypass App Whitelisting: Circumvents controls like AppLocker or Software Restriction Policies tied to RDS.
• Persistence & Lateral Movement: Maintains long-term access via RemoteApp even after other footholds are burned.

Recommendations

• Enforce strict Group Policy to manage RemoteApp behavior
• Lock down registry permissions on TSAppAllowList
• Monitor for suspicious RemoteApp-related PowerShell activity
• Correlate RDS usage with process tree anomalies and lateral movement trails
• Restrict PowerShell access using Constrained Language Mode in sensitive environments

MITRE ATT&CK Mappings