As a certified ethical hacker, you are performing a system hacking process for a company that is suspicious about its security system. You found that the company's passwords are all known words, but…

A brute-force attack attempts every possible character combination, which is computationally expensive and inefficient when a specific password modification pattern, such as adding numbers to known words, has already been identified.

A password spraying attack involves trying a small set of common passwords against many user accounts to avoid account lockouts, which does not match the scenario's focus on exploiting a specific password modification rule for individual passwords.

While a hybrid attack combines dictionary attacks with brute-force elements, a rule-based attack is a more specialized and precise form of attack when a specific, predictable transformation rule, such as consistently adding numbers, is known or suspected.

A rule-based attack applies specific, predefined transformations or 'rules' to a wordlist (like known words or dictionary entries) to generate potential passwords. The scenario explicitly states that an employee 'always changes the password by just adding some numbers to the old password,' which is a clear example of a transformation rule that can be automated and exploited by a rule-based attack. This method is highly efficient and targeted when such a predictable pattern of password modification is known.