A mobile ad hoc network is a group of wireless mobile nodes with a self-organizing system. A malicious node exhibits some unusual behavior, like sending bogus RREQs to generate sinkhole attacks. In this paper, we have presented a hybrid mechanism with three phases that are following: sinkhole indicator, detection and isolation. First, our approach finds the path where the sinkhole node is located on it. Then, the node that detects the existence of the sinkhole node will probe the other nodes to detect if any of them fail to perform the forwarding function. The proposed algorithm has lower overhead and higher time detection than other described algorithms in this paper.