Yes. Some risks will be detected only if they have an Internet connection. In case a script is downloading malicious payload, it will require an Internet connection for the behavior to be detected as malicious. In addition, some malware will not communicate with its command and control server if it doesn’t detect an Internet connection.