38. The $SECURITY_DESCRIPTOR Attribute

• Type 0x50 -- tracks the owner of the file and pemissions granted by that owner to everyone else.

• The structure changes depending on how many and what type of Access Control Lists (ACL) are present on the file. Possible entries are:

  • Attribute header

  • Revision

  • Flags

  • Offset to user SID

  • Offset to group SID

  • Offset to SACL

  • Offset to DACL

  • DACL

  • user SID

  • group SID