A system, method, and computer-program product for detecting cybersecurity threats using indicators of compromise. The system, method, and computer-program product generate threat hunt queries based on a temporal look-back parameter to retrieve historical security event data, construct detection instructions from the historical data, and reuse the threat hunt queries to retrieve, in real-time, new security event data for real-time threat detection.