diff --git a/detection_rules/etc/version.lock.json b/detection_rules/etc/version.lock.json
index 2d9875901..a1d917a55 100644
--- a/detection_rules/etc/version.lock.json
+++ b/detection_rules/etc/version.lock.json
@@ -2779,9 +2779,9 @@
   },
   "498e4094-60e7-11f0-8847-f661ea17fbcd": {
     "rule_name": "OIDC Discovery URL Changed in Entra ID",
-    "sha256": "185543b9c31b8927bc35350679662aa9800e2795ac22e2967f0fdcc21553af49",
-    "type": "query",
-    "version": 1
+    "sha256": "47e5e1ec1bd8c81aa5b602e13814559327caccb93b07ee8e756151d691089da0",
+    "type": "esql",
+    "version": 2
   },
   "4a4e23cf-78a2-449c-bac3-701924c269d3": {
     "rule_name": "Possible FIN7 DGA Command and Control Behavior",
diff --git a/pyproject.toml b/pyproject.toml
index 5b392c27f..207fa8085 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "detection_rules"
-version = "1.3.11"
+version = "1.3.12"
 description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
 readme = "README.md"
 requires-python = ">=3.12"