diff --git a/src/detection/top/top_dbsd.c b/src/detection/top/top_dbsd.c
index 858cc616d..56a572e65 100644
--- a/src/detection/top/top_dbsd.c
+++ b/src/detection/top/top_dbsd.c
@@ -28,8 +28,8 @@ const char* ffTopGetProcessSnapshot(FFlist* snapshots, FFTopTypes) {
     for (uint32_t i = 0; i < count; ++i) {
         const struct kinfo_proc* proc = &processes[i];
 
-        // Kernel threads are reported with P_SYSTEM flags and pid -1.
-        if ((proc->kp_flags & P_SYSTEM) || proc->kp_stat == SZOMB) {
+        // KERN_PROC_ALL won't return kernel threads
+        if (proc->kp_stat == SZOMB) { // Ignore zombie processes
             continue;
         }
 
diff --git a/src/detection/top/top_gnu.c b/src/detection/top/top_gnu.c
index 9bbe37aff..670f7f077 100644
--- a/src/detection/top/top_gnu.c
+++ b/src/detection/top/top_gnu.c
@@ -39,6 +39,11 @@ const char* ffTopGetProcessSnapshot(FFlist* snapshots, FFTopTypes) {
             continue;
         }
 
+        uint32_t pid = (uint32_t) proc_stat_pid(stat);
+        if (pid == 2) { // Kernel Task
+            continue;
+        }
+
         FFTopProcessSnapshot* item = FF_LIST_ADD(FFTopProcessSnapshot, *snapshots);
 
         // There is no kernel-side comm on the Hurd; use the first argument.
@@ -51,7 +56,7 @@ const char* ffTopGetProcessSnapshot(FFlist* snapshots, FFTopTypes) {
             ffStrbufAppendS(&item->name, "(unknown)");
         }
 
-        item->pid = (uint32_t) proc_stat_pid(stat);
+        item->pid = pid;
 
         if (proc_stat_has(stat, PSTAT_TASK_BASIC)) {
             const task_basic_info_t info = proc_stat_task_basic_info(stat);
diff --git a/src/detection/top/top_sunos.c b/src/detection/top/top_sunos.c
index f7e6a5f68..7dc9c880c 100644
--- a/src/detection/top/top_sunos.c
+++ b/src/detection/top/top_sunos.c
@@ -26,15 +26,21 @@ const char* ffTopGetProcessSnapshot(FFlist* snapshots, FFTopTypes showTypes) {
             continue;
         }
 
+        pstatus_t status;
+        if (ffReadFileDataRelative(subfd, "status", sizeof(status), &status) != (ssize_t) sizeof(status) ||
+            status.pr_flags & PR_ISSYS) {
+            continue; // The process may have exited, no permission or is a kernel process
+        }
+
         // The data model of the returned structure depends on the data model of
         // the calling process, not of the observed process.
         psinfo_t psinfo;
         if (ffReadFileDataRelative(subfd, "psinfo", sizeof(psinfo), &psinfo) != (ssize_t) sizeof(psinfo)) {
-            continue; // The process may have exited
+            continue;
         }
 
-        // pr_nlwp is zero for system processes and zombies
-        if (psinfo.pr_nlwp == 0 || psinfo.pr_lwp.pr_sname == 'Z') {
+        // zombies
+        if (psinfo.pr_lwp.pr_sname == 'Z') {
             continue;
         }
 
diff --git a/src/detection/top/top_windows.c b/src/detection/top/top_windows.c
index 59a5ab98d..604096403 100644
--- a/src/detection/top/top_windows.c
+++ b/src/detection/top/top_windows.c
@@ -33,7 +33,7 @@ const char* ffTopGetProcessSnapshot(FFlist* snapshots, FFTopTypes) {
         if (pidValue <= UINT32_MAX && info->CreateTime.QuadPart > 0) {
             FFTopProcessSnapshot* item = FF_LIST_ADD(FFTopProcessSnapshot, *snapshots);
             item->pid = (uint32_t) pidValue;
-            item->startTime = info->CreateTime.QuadPart > 0 ? (uint64_t) info->CreateTime.QuadPart : 0;
+            item->startTime = (uint64_t) info->CreateTime.QuadPart;
             item->cpuTime = ((uint64_t) info->UserTime.QuadPart + (uint64_t) info->KernelTime.QuadPart) / 10000u;
             item->memBytes = (uint64_t) info->VirtualMemoryCounters.WorkingSetSize;
             item->bytesRead = (uint64_t) info->IoCounters.ReadTransferCount;