Publish from Visual Studio and automatically encrypt appSettings using aspnet_regiis

After going through your all edits and a bit of research from me , you want to execute the following command after the publish from the Visual Studio

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis -pe "appSettings" -site Default -app "/"

If I understood right , You can try wrapping the ItemGroup in a Target with AfterTargets set to AddIisSettingAndFileContentsToSourceManifest

1<Target Name="executeinHosts" AfterTargets="AddIisSettingAndFileContentsToSourceManifest">
2    <ItemGroup>
3      <MsDeploySourceManifest Include="runCommand">
4       //here would be your path that need to run after the publish
5      </MsDeploySourceManifest>
6    </ItemGroup>
7  </Target>

So in Your case this is how that part should look:

1<Target Name="executeinHosts" AfterTargets="AddIisSettingAndFileContentsToSourceManifest">
2    <ItemGroup>
3      <MsDeploySourceManifest Include="runCommand">
4         <path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis -pe "appSettings" -site $(DeployIisAppPath) -app "/"</path>
5      </MsDeploySourceManifest>
6    </ItemGroup>
7  </Target>

Additional Info:

• AddIisSettingAndFileContentsToSourceManifest target works just right before Web Deploy copying files from local to server.
• aspnet_regiis can be run in <target> node by <Exec>.

Example:

<Exec Command="C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe -pef connectionStrings $(ProjectDir)obj\Debug\Package\PackageTmp" WorkingDirectory="$(publishUrl)" />