employed a PowerShell script called RDPConnectionParser to read and filter the Windows event log Microsoft-Windows-TerminalServices-RDPClient/Operational(Event ID 1024) to obtain network information from RDP connections.  has also used  from a compromised system to obtain network connection information.
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: employed a PowerShell script called RDPConnectionParser to read and filter the Windows event log Microsoft-Windows-TerminalServices-RDPClient/Operational(Event ID 1024) to obtain network information from RDP connections.  has also used  from a compromised system to obtain network connection information. ### Response: T1049.