diff --git a/src/detection/processes/processes_obsd.c b/src/detection/processes/processes_obsd.c
index d0de8170d..8c50065a0 100644
--- a/src/detection/processes/processes_obsd.c
+++ b/src/detection/processes/processes_obsd.c
@@ -13,7 +13,8 @@ const char* ffDetectProcesses(const FFProcessesOptions* options, FFProcessesResu
     }
 
     int count = 0;
-    // KERN_PROC_ALL returns all user-level processes, excluding kernel processes and threads
+    // KERN_PROC_ALL returns all user-level processes
+    // KERN_PROC_KTHREAD returns all processes, including user-level processes (despite the name)
     const struct kinfo_proc* procs = kvm_getprocs(kd,
         (options->countKprocs ? KERN_PROC_KTHREAD : KERN_PROC_ALL) | KERN_PROC_SHOW_THREADS,
         0, sizeof(struct kinfo_proc), &count);
diff --git a/src/detection/processes/processes_windows.c b/src/detection/processes/processes_windows.c
index af09f6a91..0a2ba2f41 100644
--- a/src/detection/processes/processes_windows.c
+++ b/src/detection/processes/processes_windows.c
@@ -26,11 +26,10 @@ const char* ffDetectProcesses(const FFProcessesOptions* options, FFProcessesResu
     }
 
     for (SYSTEM_PROCESS_INFORMATION* ptr = pstart; ; ptr = (SYSTEM_PROCESS_INFORMATION*) ((uint8_t*) ptr + ptr->NextEntryOffset)) {
-        if (!options->countKprocs && (uintptr_t) ptr->InheritedFromUniqueProcessId > 0) {
-            continue;
+        if (options->countKprocs || (uintptr_t) ptr->InheritedFromUniqueProcessId > 0) {
+            ++result->processes;
+            result->threads += ptr->NumberOfThreads;
         }
-        ++result->processes;
-        result->threads += ptr->NumberOfThreads;
         if (ptr->NextEntryOffset == 0) {
             break;
         }