diff --git a/src/detection/processes/processes_windows.c b/src/detection/processes/processes_windows.c
index 7ccd13149..af09f6a91 100644
--- a/src/detection/processes/processes_windows.c
+++ b/src/detection/processes/processes_windows.c
@@ -26,7 +26,7 @@ const char* ffDetectProcesses(const FFProcessesOptions* options, FFProcessesResu
     }
 
     for (SYSTEM_PROCESS_INFORMATION* ptr = pstart; ; ptr = (SYSTEM_PROCESS_INFORMATION*) ((uint8_t*) ptr + ptr->NextEntryOffset)) {
-        if (!options->countKprocs && ptr->CreateTime.QuadPart == 0) {
+        if (!options->countKprocs && (uintptr_t) ptr->InheritedFromUniqueProcessId > 0) {
             continue;
         }
         ++result->processes;
diff --git a/src/detection/top/top_windows.c b/src/detection/top/top_windows.c
index 2f1e5d66d..33a430af7 100644
--- a/src/detection/top/top_windows.c
+++ b/src/detection/top/top_windows.c
@@ -30,7 +30,7 @@ const char* ffTopGetProcessSnapshot(FFlist* snapshots, FFTopTypes) {
 
     for (SYSTEM_PROCESS_INFORMATION* info = pstart;; info = (SYSTEM_PROCESS_INFORMATION*) ((uint8_t*) info + info->NextEntryOffset)) {
         uintptr_t pidValue = (uintptr_t) info->UniqueProcessId;
-        if (pidValue <= UINT32_MAX && info->CreateTime.QuadPart > 0) {
+        if (pidValue <= UINT32_MAX && (uintptr_t) info->InheritedFromUniqueProcessId > 0) {
             FFTopProcessSnapshot* item = FF_LIST_ADD(FFTopProcessSnapshot, *snapshots);
             item->pid = (uint32_t) pidValue;
             item->startTime = (uint64_t) info->CreateTime.QuadPart;