diff --git a/knowledge base/mac os x/README.md b/knowledge base/mac os x/README.md
index f3e10d2..1a40dfe 100644
--- a/knowledge base/mac os x/README.md	
+++ b/knowledge base/mac os x/README.md	
@@ -369,8 +369,13 @@ To use any of these key combinations, press and hold the keys immediately after
 ## Further readings
 
 - [Time Machine]
+- [`tag`][tag]
+- [`sips`][sips]
+- [`defaults`][defaults]
 - [`pam_reattach`][pam_reattach]
 - [`launchctl`'s man page][launchctl man page]
+- [`mdls`][mdls]
+- [`xattr`][xattr]
 - [`macports`][macports]
 - [`openssl-osx-ca`][openssl-osx-ca]
 - [Little Snitch]
@@ -409,13 +414,16 @@ All the references in the [further readings] section, plus the following:
 [further readings]: #further-readings
 
 <!-- Knowledge base -->
+[defaults]: defaults.md
 [imagemagick]: ../imagemagick.md
 [jdberry/tag]: tag.md
 [little snitch]: little%20snitch.md
 [macports]: macports.md
 [openssl-osx-ca]: openssl-osx-ca.md
 [sips]: sips.md
+[tag]: tag.md
 [time machine]: time%20machine.md
+[xattr]: xattr.md
 
 <!-- Others -->
 [boot a mac from usb drive]: https://www.wikihow.com/Boot-a-Mac-from-USB-Drive
diff --git a/knowledge base/mac os x/defaults.md b/knowledge base/mac os x/defaults.md
new file mode 100644
index 0000000..2fcbed9
--- /dev/null
+++ b/knowledge base/mac os x/defaults.md	
@@ -0,0 +1,59 @@
+# Defaults
+
+Allows users to read, write, and delete Mac OS X user defaults from a command-line shell.
+
+Mac OS X applications and other programs use the defaults system to record user preferences and other information that must be maintained when the applications aren't running (such as default font for new documents, or the position of an Info panel).<br/>
+Much of this information is accessible through an application's Preferences panel, but some of it can only be accessed using `defaults`.
+
+User defaults belong to **domains**, which typically correspond to individual applications.<br/>
+Each domain has a dictionary of keys and values representing its defaults. Keys are always strings, but values can be complex data structures comprising arrays, dictionaries, strings, and binary data. These data structures are stored as XML Property Lists.
+
+The `NSGlobalDomain` domain is a special global domain shared by all applications, system services.<br/>
+If a default isn't specified in the application's domain but is specified in NSGlobalDomain, then the application falls back to the value in NSGlobalDomain.
+
+## Table of contents <!-- omit in toc -->
+
+1. [TL;DR](#tldr)
+1. [Further readings](#further-readings)
+
+## TL;DR
+
+```sh
+# List available domains.
+defaults domains
+
+# Read values.
+# defaults read 'domain'
+# defaults read 'domain' 'key'
+defaults read 'com.apple.dock'
+defaults read -app 'Docker' 'SUHasLaunchedBefore'
+defaults read '/Library/Preferences/SystemConfiguration/com.apple.smb.server' 'NetBIOSName'
+
+# Write or overwrite values.
+# defaults write 'domain' 'key' 'value'
+# defaults write 'domain' 'plist'
+defaults write 'com.apple.dock' 'springboard-columns' -int '9'
+defaults write -app 'DeSmuME' 'CoreControl_EnableCheats' -bool 'TRUE'
+defaults write '/Users/user/Library/Preferences/org.raspberrypi.Imager' 'imagecustomization.keyboardLayout' 'us'
+
+# Delete values.
+# defaults delete 'domain'
+# defaults delete 'domain' 'key'
+defaults delete 'com.apple.dock' 'springboard-columns'
+defaults write -app 'VLC'
+```
+
+## Further readings
+
+- [`man` page][man page]
+- [Mac OS X]
+
+<!--
+  References
+  -->
+
+<!-- Knowledge base -->
+[mac os x]: README.md
+
+<!-- Others -->
+[man page]: https://ss64.com/osx/defaults.html