Social engineering attacks terminology

Question

Let's suppose that a hacker send an email containing a Word document with a malicious macro to a sysadmin. Does this attack fall under the category of spear phishing?

Answer 1

Spear phishing mails are an attack targeted at a specific person or group. Targeting is done by providing subjects or content relevant for this group. he main difference between "normal phishing" and "spear phishing" is that the attack is only send to few people and it is more adapted to these people. This also means that often a unique or less common exploit is used in the spear phishing which will not be detected by the usual antivirus.

Thus a mail containing a document which uses macros to infect the system is not necessarily a spear phishing attack. It will be a phishing attack if it is one of these widely send mails containing alleged DHL delivery information or invoices. It will be a spear phishing attack if it is only send to the sysadmin and maybe few other people and contains information specific to their person, their work or otherwise interesting information which seduce the sysadmin to open the attached document.