The RDP interception tool used by the researchers: https://github.com/gosecure/pyrdp

I wonder if an "enterprise" version of this might exist so that companies can audit what their administrators do on high-impact systems.