vstest.console.exe

VSTest.Console.exe is the command-line tool to run tests

AWL Bypass

Proxy Execution and AWL bypass, Adversaries may run malicious code embedded inside the test methods of crafted dll/exe

vstest.console.exe {PATH:.dll}

VSTest functionality may allow an adversary to executes their malware by wrapping it as a test method then build it to a .exe or .dll file to be later run by vstest.console.exe. This may both allow AWL bypass or defense bypass in general — MITRE: T1127 — Privileges: User