Yesterday, I got an alert from a client's IDS that a Base64 auth packet was detected. Looking at the Ascii decode, I can see that it is for their OWA (Outlook Web Access), and indeed, the auth info was Base64, easily decoded to the username/password of a user.
What is odd, is that this company's Exchange server is setup to never allow connections unencrypted (via HTTP or POP/SMTP). It will always redirect http to https before authentication is required.
Since getting this alert, I have queried for other alerts of the same kind, but cannot find much more... It seems to be an edge case.
Any ideas on what is going on?
=====Ascii Decode of packet====