diff --git a/src/common/impl/processing_windows.c b/src/common/impl/processing_windows.c
index ebfe5d82b..f0dc096cd 100644
--- a/src/common/impl/processing_windows.c
+++ b/src/common/impl/processing_windows.c
@@ -2,6 +2,7 @@
 #include "common/processing.h"
 #include "common/io.h"
 #include "common/windows/unicode.h"
+#include "common/windows/nt.h"
 
 #include <stdalign.h>
 #include <windows.h>
@@ -213,7 +214,7 @@ exit:
 bool ffProcessGetInfoWindows(uint32_t pid, uint32_t* ppid, FFstrbuf* pname, FFstrbuf* exe, const char** exeName, FFstrbuf* exePath, bool* gui)
 {
     FF_AUTO_CLOSE_FD HANDLE hProcess = pid == 0
-        ? GetCurrentProcess()
+        ? NtCurrentProcess()
         : OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, pid);
 
     if (hProcess == NULL)
diff --git a/src/common/windows/nt.h b/src/common/windows/nt.h
index 66e3b4476..b4d83d66a 100644
--- a/src/common/windows/nt.h
+++ b/src/common/windows/nt.h
@@ -266,3 +266,7 @@ typedef struct _PROCESS_DEVICEMAP_INFORMATION_EX
     };
     ULONG Flags; // PROCESS_LUID_DOSDEVICES_ONLY
 } PROCESS_DEVICEMAP_INFORMATION_EX, *PPROCESS_DEVICEMAP_INFORMATION_EX;
+
+#ifndef NtCurrentProcess
+#define NtCurrentProcess() ((HANDLE)(LONG_PTR)-1)
+#endif
diff --git a/src/detection/bootmgr/bootmgr_windows.c b/src/detection/bootmgr/bootmgr_windows.c
index cb6a974b3..3fe46b161 100644
--- a/src/detection/bootmgr/bootmgr_windows.c
+++ b/src/detection/bootmgr/bootmgr_windows.c
@@ -1,13 +1,14 @@
 #include "bootmgr.h"
 #include "efi_helper.h"
 #include "common/io.h"
+#include "common/windows/nt.h"
 
 #include <windows.h>
 
 const char* enablePrivilege(const wchar_t* privilege)
 {
     FF_AUTO_CLOSE_FD HANDLE token = NULL;
-    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &token))
+    if (!OpenProcessToken(NtCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &token))
         return "OpenProcessToken() failed";
 
     TOKEN_PRIVILEGES tp = {
diff --git a/src/detection/disk/disk_windows.c b/src/detection/disk/disk_windows.c
index 63aac6199..47cd3f504 100644
--- a/src/detection/disk/disk_windows.c
+++ b/src/detection/disk/disk_windows.c
@@ -12,7 +12,7 @@ const char* ffDetectDisksImpl(FFDiskOptions* options, FFlist* disks)
 {
     PROCESS_DEVICEMAP_INFORMATION_EX info = {};
     ULONG size = 0;
-    if(!NT_SUCCESS(NtQueryInformationProcess(GetCurrentProcess(), ProcessDeviceMap, &info, sizeof(info), &size)))
+    if(!NT_SUCCESS(NtQueryInformationProcess(NtCurrentProcess(), ProcessDeviceMap, &info, sizeof(info), &size)))
         return "NtQueryInformationProcess(ProcessDeviceMap) failed";
 
     // For cross-platform portability; used by `presets/examples/13.jsonc`
diff --git a/src/detection/terminalshell/terminalshell_windows.c b/src/detection/terminalshell/terminalshell_windows.c
index 9384b41bb..b412d5800 100644
--- a/src/detection/terminalshell/terminalshell_windows.c
+++ b/src/detection/terminalshell/terminalshell_windows.c
@@ -6,6 +6,7 @@
 #include "common/windows/registry.h"
 #include "common/windows/unicode.h"
 #include "common/windows/version.h"
+#include "common/windows/nt.h"
 #include "common/stringUtils.h"
 
 #include <stdalign.h>
@@ -223,7 +224,7 @@ static bool detectDefaultTerminal(FFTerminalResult* result)
 conhost:;
     ULONG_PTR conhostPid = 0;
     ULONG size;
-    if(NT_SUCCESS(NtQueryInformationProcess(GetCurrentProcess(), ProcessConsoleHostProcess, &conhostPid, sizeof(conhostPid), &size)) && conhostPid != 0)
+    if(NT_SUCCESS(NtQueryInformationProcess(NtCurrentProcess(), ProcessConsoleHostProcess, &conhostPid, sizeof(conhostPid), &size)) && conhostPid != 0)
     {
         // For Windows Terminal, it reports the PID of OpenConsole
         if(ffProcessGetInfoWindows((uint32_t) conhostPid, NULL, &result->processName, &result->exe, &result->exeName, &result->exePath, NULL))