The problem isn't filtering but determining what to look for - a lot of these are hosted on things like AWS or some CDN, which means machines with very generic hostnames, and you'd have to catch a meaningful DNS lookup to get started. If the traffic is encrypted, you still have no great idea what's actually being sent (is it fragments of the file you're working on, which keys you've pressed in the last 10 secons, or an automatic update check? They could all be similar sizes), and if the application is doing security "correctly" it will be very hard to MITM.

It's actually pretty easy to mitm your own https with tools like mitmproxy: https://mitmproxy.org/

But in this case getting the application to use the proxy may have been tricky.

Wireshark's display filters are much nicer than tcpdump's BPF; a much simpler language definition.

Known as "capture filters" in Wireshark and as easy as: "host www.afterthedeadline.com".