diff --git a/CMakeLists.txt b/CMakeLists.txt
index d52eb0da3..7c4071ea0 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1035,7 +1035,7 @@ elseif(WIN32)
         src/detection/physicalmemory/physicalmemory_linux.c
         src/detection/netio/netio_windows.c
         src/detection/opengl/opengl_windows.c
-        src/detection/os/os_windows.c
+        src/detection/os/os_windows.cpp
         src/detection/packages/packages_windows.c
         src/detection/poweradapter/poweradapter_nosupport.c
         src/detection/processes/processes_windows.c
@@ -1689,7 +1689,6 @@ elseif(WIN32)
         PRIVATE "wtsapi32"
         PRIVATE "imagehlp"
         PRIVATE "cfgmgr32"
-        PRIVATE "winbrand"
         PRIVATE "propsys"
         PRIVATE "secur32"
     )
diff --git a/src/detection/os/os_windows.c b/src/detection/os/os_windows.cpp
similarity index 70%
rename from src/detection/os/os_windows.c
rename to src/detection/os/os_windows.cpp
index 1b6cc2e92..39ce406e4 100644
--- a/src/detection/os/os_windows.c
+++ b/src/detection/os/os_windows.cpp
@@ -1,10 +1,31 @@
+extern "C" {
 #include "os.h"
 #include "common/library.h"
-#include "util/windows/unicode.h"
 #include "util/stringUtils.h"
 #include "util/windows/registry.h"
+}
+#include "util/windows/unicode.hpp"
+#include "util/windows/wmi.hpp"
 
-#include <windows.h>
+static const char* getOsNameByWmi(FFstrbuf* osName)
+{
+    FFWmiQuery query(L"SELECT Caption FROM Win32_OperatingSystem");
+    if(!query)
+        return "Query WMI service failed";
+
+    if(FFWmiRecord record = query.next())
+    {
+        if(auto vtCaption = record.get(L"Caption"))
+        {
+            ffStrbufSetWSV(osName, vtCaption.get<std::wstring_view>());
+            ffStrbufTrimRight(osName, ' ');
+            return NULL;
+        }
+        return "Get Caption failed";
+    }
+
+    return "No WMI result returned";
+}
 
 PWSTR WINAPI BrandingFormatString(PCWSTR format);
 
@@ -24,19 +45,32 @@ static bool getCodeName(FFOSResult* os)
     return true;
 }
 
-void ffDetectOSImpl(FFOSResult* os)
+static const char* getOsNameByWinbrand(FFstrbuf* osName)
 {
     //https://dennisbabkin.com/blog/?t=how-to-tell-the-real-version-of-windows-your-app-is-running-on#ver_string
-    const wchar_t* rawName = BrandingFormatString(L"%WINDOWS_LONG%");
-    ffStrbufSetWS(&os->variant, rawName);
+    FF_LIBRARY_LOAD(winbrand, "dlopen winbrand" FF_LIBRARY_EXTENSION " failed", "winbrand" FF_LIBRARY_EXTENSION, 1);
+    FF_LIBRARY_LOAD_SYMBOL_MESSAGE(winbrand, BrandingFormatString);
+
+    const wchar_t* rawName = ffBrandingFormatString(L"%WINDOWS_LONG%");
+    ffStrbufSetWS(osName, rawName);
     GlobalFree((HGLOBAL)rawName);
-    ffStrbufSet(&os->prettyName, &os->variant);
+    return NULL;
+}
+
+extern "C"
+void ffDetectOSImpl(FFOSResult* os)
+{
+    if(getOsNameByWinbrand(&os->variant) && getOsNameByWmi(&os->variant))
+        return;
+
     ffStrbufTrimRight(&os->variant, ' ');
 
     //WMI returns the "Microsoft" prefix while BrandingFormatString doesn't. Make them consistent.
     if(ffStrbufStartsWithS(&os->variant, "Microsoft "))
         ffStrbufSubstrAfter(&os->variant, strlen("Microsoft ") - 1);
 
+    ffStrbufSet(&os->prettyName, &os->variant);
+
     if(ffStrbufStartsWithS(&os->variant, "Windows "))
     {
         ffStrbufAppendS(&os->name, "Windows");