Surveillance WSNs are deployed in hostile environments such as perimeter, border locations and battlefields to detect unauthorized intrusions. Therefore, Surveillance WSNs are highly vulnerable to collaborative work of attackers to compromise many legitimate nodes. Securing surveillance WSNs is challenging because of low-cost, limited capabilities, resource-constrained sensor nodes. Several protocols have been proposed for detecting compromised nodes. However, some protocols rely on an implicit assumption that compromised node will change its location or its signal strength will alter after it is compromised; other protocols use alert messages or reputation based trust models which require the nodes misbehavior to discover the compromised nodes. Node compromise attack is a multi-stage attack which consists of three stages: physically capturing and compromising sensor nodes; redeploying the compromised nodes back to network and compromised sensor nodes rejoining the network. Our work studies how to achieve high resiliency against an increasing number of compromised nodes in large surveillance WSN in hostile environment by collaborative work of attackers at the first stage. Specifically, after sensor nodes are deployed they first build overlapped groups in ad hoc pattern where a group is composed of four nodes. Then, the nodes within the overlapped groups can monitor each other to detect any node compromise attempt. We describe the building blocks that can be used to build the protocol for the detection process. Our protocol is designed to be resistant against large number of compromised nodes by collaborative work of attackers. Extensive simulation results are given to demonstrate the high detection rate of the proposed scheme.