Wireless Sensor Network (WSN) technology operates without a centralized controller for data transmission. Due to the network’s dynamic nature, it’s possible for malicious nodes to join or leave, potentially launching attacks like sink hole assaults. These attacks involve impostor nodes pretending to be sinks in order to intercept data packets. This research proposes a two-stage approach to identify these malicious nodes. The first stage focuses on identifying potential attacker nodes in the network, while the subsequent stage aims to detect the actual malicious nodes. The proposed technique is evaluated using NS2 (Network Simulator 2), and the results are analyzed based on metrics such as throughput, packet loss, and delay. The findings demonstrate that this approach outperforms traditional methods in detecting malicious nodes.