Sensor nodes can be compromised by attackers and inject large amounts of bogus data to exhaust network resources. Enroute filtering is an effective way to defeat false data injection attacks. We consider two factors that often are overlooked before: coverage and realtimeness. A stepwise refinement distributed group joining method is proposed to improve the coverage performance. Enroute nodes dynamically determine whether first to verify a message or first to forward the message. If the network is attacked, the forwarding nodes will verify messages first; otherwise, forwarding nodes will forward message first. We compare the proposed scheme with the traditional ones, and show that the scheme can improve coverage and reduce delay efficiently.