For more detailed technical analysis, you can view the original research on the Varonis Blog .
The vulnerability relies on the way Windows handles SID resolution. Because the system allows adding SIDs that aren't yet mapped to a user, the ACL essentially waits for its "missing half".
Yes, identified a technique known as Synthetic SID Injection .
An attacker with high privileges (but perhaps needing to maintain long-term, hidden access) adds a non-existent SID to a resource's ACL.
Once a new user or group is created and assigned that specific SID, they automatically inherit all the "synthetic" permissions previously injected, often without appearing in standard audit logs as a new permission grant. Why This Matters