I think what you would wind up doing is breaking out each ACE and creating lookups for each of the different components. I think the quickest approach would be to extract each ACE, which will lead to the ACE field often being a multivalue field. Then use mvexpand which will then allow lookups against each of the ACE components. There number of ACEs in a security descriptor is variable, doing this in search is going to be somewhat complex.
Here's a link to a good breakdown of how each ACE is constructed and what the strings mean: