Disturbances and attacks co‐exist widely in networked systems. Distributed state estimation of networked systems in the simultaneous presence of disturbances and attacks has been widely recognized as a challenging issue. In this article, an enhanced three‐stage approach for the detection and rejection of attacks is established for networked systems subject to multiple disturbances and false data injection (FDI) attacks. First, a multi‐layer distributed estimator with a disturbance observer layer is proposed. Then, an optimal observer‐based attack detection scheme is designed to specify an attack detection logic. After disturbance rejection and attack detection, an attack‐resilient estimator with a dynamic detection‐triggered structure is proposed to actively reject FDI attacks online. This three‐stage approach effectively separates the influence of disturbances and attacks in the distributed estimation process, enabling multiple heterogeneous disturbances and attacks across the sensor network to be rejected. A numeric example and comparisons are provided to illustrate the effectiveness of the proposed approach.